乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-30: 细节已通知厂商并且等待厂商处理中 2015-12-30: 厂商已经确认,细节仅向厂商公开 2016-01-09: 细节向核心白帽子及相关领域专家公开 2016-01-19: 细节向普通白帽子公开 2016-01-29: 细节向实习白帽子公开 2016-02-12: 细节向公众公开
漏洞打包(未授权访问&SQL注入)
地址:http://180.169.5.248/feedBackIssus/index隔壁ip.249是https://mailsh.tct.tcl.com回到我们的问题系统
这样的记录有4000多条,貌似是tcl手机在测试?ie6下才支持翻页不同地点不同人在测,记录持续更新
该系统同时也存在SQL注入
GET http://180.169.5.248/feedBackIssus/index?FeedBackIssus%5Bfrom_date%5D=1990-01-01+00%3A00&FeedBackIssus%5Bto_date%5D=2015-12-30+00%3A00&FeedBackIssus%5Bissus_id%5D=&FeedBackIssus%5Bemail%5D=&FeedBackIssus%5Bimei_code%5D=&FeedBackIssus%5Bduplicate_issus_id%5D=&FeedBackIssus%5Bcom_ref%5D=&FeedBackIssus%5Bsim_operator%5D=&FeedBackIssus%5Blocation%5D=&FeedBackIssus%5Bissus_title%5D=&FeedBackIssus%5Bperso%5D=&FeedBackIssus%5Bswts%5D=&FeedBackIssus%5Balm_id%5D=&FeedBackIssus%5Bissus_fixed_version%5D=&FeedBackIssus%5Bproject_name%5D=&FeedBackIssus%5Bfeed_back_issus_type_name%5D= HTTP/1.1Host: 180.169.5.248Connection: keep-aliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36Referer: http://180.169.5.248/feedBackIssus/index?FeedBackIssus%5Bfrom_date%5D=2015-12-01+00%3A00&FeedBackIssus%5Bto_date%5D=2015-12-30+00%3A00&FeedBackIssus%5Bissus_id%5D=&FeedBackIssus%5Bemail%5D=&FeedBackIssus%5Bimei_code%5D=&FeedBackIssus%5Bduplicate_issus_id%5D=&FeedBackIssus%5Bcom_ref%5D=&FeedBackIssus%5Bsim_operator%5D=&FeedBackIssus%5Blocation%5D=&FeedBackIssus%5Bissus_title%5D=&FeedBackIssus%5Bperso%5D=&FeedBackIssus%5Bswts%5D=&FeedBackIssus%5Balm_id%5D=&FeedBackIssus%5Bissus_fixed_version%5D=&FeedBackIssus%5Bproject_name%5D=&FeedBackIssus%5Bfeed_back_issus_type_name%5D=Accept-Encoding: gzip, deflate, sdchAccept-Language: zh-CN,zh;q=0.8Cookie: PHPSESSID=24kq30am6juhtq1egqq92l47t0; from_date=2015-12-01+00%3A00; to_date=2015-12-30+00%3A00
注入点很多,跑久了数据库会崩溃的样子
读一下
数据库崩的时候就这样
最好下线
危害等级:中
漏洞Rank:8
确认时间:2015-12-30 15:32
测试人员在没有任何安全措施的情况下进行测试 ,现在已经通知整改,感谢您对TCL的关注。谢谢!
暂无