乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-09-08: 细节已通知厂商并且等待厂商处理中 2015-09-10: cncert国家互联网应急中心暂未能联系到相关单位,细节仅向通报机构公开 2015-09-20: 细节向核心白帽子及相关领域专家公开 2015-09-30: 细节向普通白帽子公开 2015-10-10: 细节向实习白帽子公开 2015-10-25: 细节向公众公开
看到最近很多城市都建立起自己的云平台来管理居民信息,这样确实很cool但是问题来了,所有东西都联网真的好吗?技术更不上想法,后果谁来负责?------------------------------分割线--------------------------------第一次遇到这样的情况,不知道怎么利用, 百度了一下proxool-0.9.0RC3 ,知道这是一个非常不错的java连接池源码,功能强大的插件,难道是用完了没有删除?然后在wooyun上看到了一个相同类型的案例:<code>http://www.wooyun.org/bugs/wooyun-2010-039092</code>,好像也没有利用。那就来看一下都有哪些信息吧
#1、问题网站:
http://**.**.**.**/#
#2、问题URL:
http://**.**.**.**/admin?alias=photo&tab=definition
#3、敏感信息:
alias: oracledriver-url: jdbc:oracle:thin:@**.**.**.**:1521:ksrkdriver-class: oracle.jdbc.driver.OracleDriverminimum-connection-count: 10maximum-connection-count: 500prototype-count: -simultaneous-build-throttle: 10maximum-connection-lifetime: 00:02:00maximum-active-time: 00:00:20house-keeping-sleep-time: 30shouse-keeping-test-sql: select * from TB_EMPLOYEEtest-before-use: falsetest-after-use: falserecently-started-threshold: 00:01:00overload-without-refusal-lifetime: 00:01:00injectable-connection-interface: -injectable-statement-interface: -injectable-callable-statement-interface: -injectable-prepared-statement-interface: -fatal-sql-exception: ORA-, ora-, socket write errorfatal-sql-exception-wrapper-class: org.logicalcobwebs.proxool.FatalRuntimeExceptionstatistics: -statistics-log-level: -verbose: truetrace: trueuser (delegated): ksrkpassword (delegated): ******dll (delegated): ocijdbc9protocol (delegated): thin
alias: szdsrkdriver-url: jdbc:oracle:thin:@**.**.**.**:1521:SSZRKdriver-class: oracle.jdbc.driver.OracleDriverminimum-connection-count: 5maximum-connection-count: 150prototype-count: -simultaneous-build-throttle: 10maximum-connection-lifetime: 00:10:00maximum-active-time: 00:03:00house-keeping-sleep-time: 30shouse-keeping-test-sql: select * from TB_EMPLOYEEtest-before-use: falsetest-after-use: falserecently-started-threshold: 00:01:00overload-without-refusal-lifetime: 00:01:00injectable-connection-interface: -injectable-statement-interface: -injectable-callable-statement-interface: -injectable-prepared-statement-interface: -fatal-sql-exception: ORA-, ora-, socket write errorfatal-sql-exception-wrapper-class: org.logicalcobwebs.proxool.FatalRuntimeExceptionstatistics: -statistics-log-level: -verbose: truetrace: trueuser (delegated): SRKpassword (delegated): ******dll (delegated): ocijdbc9protocol (delegated): thin
alias: oracleStart date: 02-??-2015 00:01:26Snapshot: 22:07:02Connections: 0 (active), 10 (available), 500 (max) Served: 5957Refused: 0Details:(click ID to drill down) # born laststart lap(ms) thread56727 22:06:47 - -56726 22:06:47 - -56725 22:06:47 - -56724 22:06:47 - -56723 22:06:47 - -56722 22:06:47 - -56721 22:06:47 - -56720 22:06:47 - -56719 22:06:47 - -56718 22:06:47 - -
泄露数据库用户名:
全面检测一下网站
危害等级:中
漏洞Rank:6
确认时间:2015-09-10 17:29
CNVD确认并复现所述情况,已经转由CNCERT下发给江苏分中心,由其后续协调网站管理单位处置。
暂无