当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0122916

漏洞标题:西部数码某分站SQL注射漏洞

相关厂商:西部数码

漏洞作者: 骸骸

提交时间:2015-06-26 15:34

修复时间:2015-06-26 15:55

公开时间:2015-06-26 15:55

漏洞类型:SQL注射漏洞

危害等级:低

自评Rank:5

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-26: 细节已通知厂商并且等待厂商处理中
2015-06-26: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

见说明!

详细说明:

之前提交的主站漏洞本人验证后,确实危害不大,不能拿到啥数据,但是分站可以的
分站注入地址:http://javatest.west263.com/userlist.jsp?sortfield=userid
可以拿到一些用户信息,但是注册人数很少- -

Database: javatest
[61 tables]
+-------------------------+
| ejf_admin_log |
| ejf_archive_reply |
| ejf_archive_topic |
| ejf_attach |
| ejf_backup_task |
| ejf_board |
| ejf_bookmark |
| ejf_censor_log |
| ejf_credits_log |
| ejf_error_log |
| ejf_friend |
| ejf_group |
| ejf_moderator_log |
| ejf_reply |
| ejf_report_log |
| ejf_section |
| ejf_short_msg |
| ejf_topic |
| ejf_trash_box |
| ejf_user |
| ejf_visit_stat |
| jforum_attach |
| jforum_attach_desc |
| jforum_attach_quota |
| jforum_banlist |
| jforum_banner |
| jforum_bookmarks |
| jforum_categories |
| jforum_config |
| jforum_extension_groups |
| jforum_extensions |
| jforum_forums |
| jforum_forums_watch |
| jforum_groups |
| jforum_karma |
| jforum_posts |
| jforum_posts_text |
| jforum_privmsgs |
| jforum_privmsgs_text |
| jforum_quota_limit |
| jforum_ranks |
| jforum_role_values |
| jforum_roles |
| jforum_search_results |
| jforum_search_topics |
| jforum_search_wordmatch |
| jforum_search_words |
| jforum_sessions |
| jforum_smilies |
| jforum_themes |
| jforum_topics |
| jforum_topics_watch |
| jforum_user_groups |
| jforum_users |
| jforum_vote_desc |
| jforum_vote_results |
| jforum_vote_voters |
| jforum_words |
| t_admin |
| t_catalog |
| t_post |
+-------------------------+

漏洞证明:

Database: javatest
[61 tables]
+-------------------------+
| ejf_admin_log |
| ejf_archive_reply |
| ejf_archive_topic |
| ejf_attach |
| ejf_backup_task |
| ejf_board |
| ejf_bookmark |
| ejf_censor_log |
| ejf_credits_log |
| ejf_error_log |
| ejf_friend |
| ejf_group |
| ejf_moderator_log |
| ejf_reply |
| ejf_report_log |
| ejf_section |
| ejf_short_msg |
| ejf_topic |
| ejf_trash_box |
| ejf_user |
| ejf_visit_stat |
| jforum_attach |
| jforum_attach_desc |
| jforum_attach_quota |
| jforum_banlist |
| jforum_banner |
| jforum_bookmarks |
| jforum_categories |
| jforum_config |
| jforum_extension_groups |
| jforum_extensions |
| jforum_forums |
| jforum_forums_watch |
| jforum_groups |
| jforum_karma |
| jforum_posts |
| jforum_posts_text |
| jforum_privmsgs |
| jforum_privmsgs_text |
| jforum_quota_limit |
| jforum_ranks |
| jforum_role_values |
| jforum_roles |
| jforum_search_results |
| jforum_search_topics |
| jforum_search_wordmatch |
| jforum_search_words |
| jforum_sessions |
| jforum_smilies |
| jforum_themes |
| jforum_topics |
| jforum_topics_watch |
| jforum_user_groups |
| jforum_users |
| jforum_vote_desc |
| jforum_vote_results |
| jforum_vote_voters |
| jforum_words |
| t_admin |
| t_catalog |
| t_post |
+-------------------------+

修复方案:

过滤

版权声明:转载请注明来源 骸骸@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-06-26 15:55

厂商回复:

java功能演示站点,没有重要数据

最新状态:

暂无