乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-05-27: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-07-11: 厂商已经主动忽略漏洞,细节向公众公开
前人有经验: WooYun: 某教育类CMS通用sql注入 厂商:
http://www.ecs.cn/ 易创思(ECS)上海弘育信息技术有限公司
SQL注入:(需注册普通用户账号登录,注册无任何限制)
/BlogManage/Friend/MyFriends.aspx 搜索处的txtFriendName参数存在注入
Case:
http://www.yhsyxx.com:81/Login.aspxhttp://www.hbycscjzx.com/login.aspxhttp://www.jhyzh.com/login.aspxhttp://www.bkjyj.cn/login.aspxhttp://www.rzk9.com/login.aspx
以第一例做测试,注册账号wooyun 密码a123456
POST /BlogManage/Friend/MyFriends.aspx HTTP/1.1Host: www.*****.comProxy-Connection: keep-aliveContent-Length: 1192Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.*****.comUser-Agent: ************Content-Type: application/x-www-form-urlencodedReferer: http://www.*****.com/BlogManage/Friend/MyFriends.aspxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: ASP.NET_SessionId=ioas0hvagtymppqjaak4ab45; GrowUpEdu_RecordStatTimeCookie_Site=GrowUpEdu_RecordStatTimeCookie_Site_value=GrowUpEdu_RecordStatTimeCookie_Site; GrowUpEdu=2D956AC0E4FC0A6D0177006F006F00790075006E000000D0A36F5CA697D00100D0DBBC81BF97D00142006C006F0067004000330061003800610035006400370033002D0061003200610065002D0034003700340035002D0038003700630038002D0036006600350037003900370034003700610037003200350000002F000000; MyHomeNav=office__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=%2FwEPDwUKMTMzNzUwNDA0NQ9kFgICAw9kFgpmDxAPFgIeC18hRGF0YUJvdW5kZ2QQFQEM5YWo6YOo5aW95Y%2BLFQEBMBQrAwFnFgFmZAIBDw8WAh4HVmlzaWJsZWdkZAIEDzwrAA0BAA8WBB8AZx4LXyFJdGVtQ291bnRmZGQCBQ8PFhYeDE5leHRQYWdlVGV4dAUG5LiL6aG1Hg1TaG93UGFnZUluZGV4aB4LUmVjb3JkY291bnRmHg1JbnB1dEJveENsYXNzBQhwYXBlcmJveB4VU2hvd05hdmlnYXRpb25Ub29sVGlwZx4MUHJldlBhZ2VUZXh0BQbkuIrpobUeEVN1Ym1pdEJ1dHRvbkNsYXNzBQhwYXBlcmJ0bh4NRmlyc3RQYWdlVGV4dAUG6aaW6aG1HghQYWdlU2l6ZQIPHgxMYXN0UGFnZVRleHQFBuacq%2BmhtR4MU2hvd0lucHV0Qm94KCleV3VxaS5XZWJkaXllci5TaG93SW5wdXRCb3gsIEFzcE5ldFBhZ2VyLCBWZXJzaW9uPTUuMC4xLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49bnVsbAZBbHdheXNkZAIGDw8WAh4EVGV4dAWHAemhtTxmb250IGNvbG9yPXJlZD48c3Ryb25nPjE8L3N0cm9uZz48L2ZvbnQ%2BLzxmb250IGNvbG9yPXJlZD48c3Ryb25nPjA8L3N0cm9uZz48L2ZvbnQ%2BIOWFsTxmb250IGNvbG9yPXJlZD48c3Ryb25nPjA8L3N0cm9uZz48L2ZvbnQ%2BIOadoWRkGAEFCWd2RnJpZW5kcw88KwAKAQhmZBbGGzVOL3cNNJwF%2B5P%2BpX%2BhnYig&__EVENTVALIDATION=%2FwEWBgLg5vHLCwLWyqy3BALGpYbZCALugcLABgKln%2FPuCgL5jolPbU%2ByLBCTRfIoCv4LrnnZA92Ub6A%3D&ddlFriendGroup=0&txtFriendName=aaaa&btnSearch=%E6%90%9C+%E7%B4%A2&friendsAspNetPager_input=1 盲注就不读库名了:
盲注就不读库名了:
未能联系到厂商或者厂商积极拒绝