乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-02: 细节已通知厂商并且等待厂商处理中 2015-10-13: 厂商已经主动忽略漏洞,细节向公众公开
web.config
http://42.62.24.19/empty.zip压缩包里有三个配置文件泄露数据库账号密码,新浪微博账号密码,重置密码的邮箱账号密码及后台管理员账号密码可通过邮箱可获得管理员qq邮箱并进一步利用
<customizeConfig> <!--[Flags]public enum AdoParam : int { Query = 1, Insert = 2, Delete = 4, Update = 8, Select = 16, }--> <LiuLQ.Data.DataStream> <add title="Sql Server" type="Int:bit|smallint|int, Long:bigint|long|real, Double:float|numeric, Decimal:decimal, DateTime:date|datetime|smalldatetime,
 Bytes:binary|image|money|varbinary, String:char|nvarchar|varchar|nchar|ntext|text" /> <add title="sqlite" type="Int:integer" /> </LiuLQ.Data.DataStream> <LiuLQ.Data.AdoHelper Cipher="LKJHGFDSAMNBVCXZ" StopParams="BitArrayEnumBitString[AdoParam]" _dataBase="LiuLQ.Data.SqlServer, LiuLQ.Base; server=192.168.0.48;uid=dbshine;pwd=shine@xxbmm#21;database=ShopMaternal;" /> <LiuLQ.Web.CacheHelper CookieDomain="" CookieCacheDays="30" CacheMinutes="10" /> <Weibo.Api.WeiboCore HelperId="11" LogApiException="true" EncodingTenxunWeibo="UTF-8" EncodingSinaWeibo="UTF-8" EncodingQQConnect="UTF-8" AppTenxunWeibo="Tx801452057" AppSinaWeibo="Sina3296273" AppQQConnect="QQ100570068"> <AddApply Appkey="3296273" Appsecret="ca17cc385497e6808149b1361a247620" Platform="Sina" key="Sina3296273" AppTitle="新浪:天上掉馅饼" /> <AddApply Appkey="801452057" Appsecret="9ab0b965f276044f0853cbb888ea91ad" Platform="Tenxun" key="Tx801452057" /> <AddApply Appkey="100570068" Appsecret="98813e73bb710f634a5c2f197cb8d7bc" Platform="QQConnect" key="QQ100570068" /> </Weibo.Api.WeiboCore> <!-- CatchException : Catch = 1, Log = 2, LogComplete = 4, --> <ShopMaternal.Base.WebCore CatchException="0" DbHelper="100" AouthorHelper="101" WebHost="http://m.xxbmm.com" ApplyPath="/shine" IsWap="true" ApiUri="http://192.168.1.46/xxbmm_s" IconPath="/upload/Icon/" PgLoadCount="3"> <ManagerOption CookName="AdminSignIdentity" SignUrl="/Mgr/Login" /> <SignerCookie Key="SignAccount" Domain="" CacheDays="30" SignUrl="/SignUrl" /> </ShopMaternal.Base.WebCore> <ShopMaternal.Base.MailHelper MailSendPort="25" WebEncoding="UTF-8" EmailServer="smtp.qq.com" IsHtmlBody="true" EmailFromAddress="[email protected]" EmailFromPassword="[email protected]" EmailFromAddressNick="小小包麻麻" ActiveMailSubject="小小包麻麻网站账户激活邮件" ActiveMailAddress="~/App_Data/ActiveMail.html" FindPasswordSubject="小小包麻麻网站找回账户密码" FindPasswordAddress="~/App_Data/FindPwdMail.html" /> </customizeConfig> <appSettings/> <connectionStrings> <add name="ApplicationServices" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>
限制访问
危害等级:无影响厂商忽略
忽略时间:2015-10-13 09:00
漏洞Rank:2 (WooYun评价)
暂无