乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-05-24: 细节已通知厂商并且等待厂商处理中 2016-05-24: 厂商已经确认,细节仅向厂商公开 2016-06-03: 细节向核心白帽子及相关领域专家公开 2016-06-13: 细节向普通白帽子公开 2016-06-23: 细节向实习白帽子公开 2016-07-08: 细节向公众公开
XSS都上首页了,我就看看注入能不能上!
http://contact.mercedes-benz.com.cn/brochure点下一步,抓包
POST /brochure/step2/ HTTP/1.1Host: contact.mercedes-benz.com.cnContent-Length: 70Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://contact.mercedes-benz.com.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://contact.mercedes-benz.com.cn/brochureAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: PHPSESSID=ul66o7454t918hh2ks8n3s57m7; __utmt=1; ci_session=a%3A6%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%2210a91a67e8788c3282939fd309e6b271%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A12%3A%22218.76.52.35%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F5.0+%28Windows+NT+6.1%29+AppleWebKit%2F537.36+%28K%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1464052522%3Bs%3A8%3A%22language%22%3Bs%3A2%3A%22en%22%3Bs%3A11%3A%22FROMOUTSIDE%22%3Bs%3A12%3A%22s65l-amg-emb%22%3B%7D695dc30a665d0b8c0482a2d2bfa503aa; Hm_lvt_57598b78701bc42043be8024c2fb48e8=1464052727,1464053171; Hm_lpvt_57598b78701bc42043be8024c2fb48e8=1464053317; __utma=259003544.1090275646.1464052727.1464052727.1464053171.2; __utmb=259003544.7.10.1464053171; __utmc=259003544; __utmz=259003544.1464053171.2.2.utmcsr=baidu|utmccn=(organic)|utmcmd=organicmodel%5B%5D=38&model%5B%5D=9&model%5B%5D=52&refererpage=brochure_step1
model存在注入
NULL
危害等级:中
漏洞Rank:10
确认时间:2016-05-24 10:58
确认此漏洞,感谢乌云平台及作者路人甲对我公司及时提出预警!
暂无