乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-09-28: 细节已通知厂商并且等待厂商处理中 2013-10-15: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放 2013-12-09: 细节向核心白帽子及相关领域专家公开 2013-12-19: 细节向普通白帽子公开 2013-12-29: 细节向实习白帽子公开 2013-12-24: 细节向公众公开
easytalk是一个,优秀的开源微博CMS
easytalkCSRF可蠕虫发微博可用于各个方面,例如广告传销,一发不可收拾
抓包得:
POST /?m=space&a=sendmsg HTTP/1.1Host: t.nextsns.comConnection: Keep-AliveContent-Length: 51Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; SE 2.X MetaSr 1.0)accept-language: zh-cncontent-type: application/x-www-form-urlencodedx-requested-with: XMLHttpRequestReferer: http://t.nextsns.com/?aaaaassssAccept-Encoding: gzip, deflateCookie: Hm_lvt_a8430e60d731ee48d6af1a7f5be443cb=1380280087; Hm_lpvt_a8430e60d731ee48d6af1a7f5be443cb=1380280087; think_language=zh-cn; SSXTID=8c9639fad140162f9b6ba096a2ed6192; CNZZDATA2926394=cnzz_eid%3D1360978696-1380280089-http%253A%252F%252Ft.nextsns.com%26ntime%3D1380280089%26cnzz_a%3D0%26retime%3D1380280090818%26sin%3Dhttp%253A%252F%252Fwww.nextsns.com%252F%26ltime%3D1380280090818%26rtime%3D0; starttime=1380280328255; authcookie=czo2MzoiMTlhMWFHQmN4KzdSR1VNMWVxTjYwc2FsdDhWcUZuU2YxQURvR1UxSlcxVHVCMU9NYzZyV1UwbVZpR2tSb0c4Ijs%3Dcontent=tset&morecontent=&sendsina=0&sendqq=0&from=
Poc:
测试结果:
加token.
危害等级:无影响厂商忽略
忽略时间:2013-12-24 16:01
2013-10-14:漏洞正在解决