当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0132666

漏洞标题：中兴某站GETSHELL（任意添加管理员/数据库文件下载/多个后台同时沦陷/包括wiki系统等/大量API接口外漏）

相关厂商：中兴通讯股份有限公司

漏洞作者： Mr.Q

提交时间：2015-08-08 19:17

修复时间：2015-09-23 15:48

公开时间：2015-09-23 15:48

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-08： 细节已通知厂商并且等待厂商处理中
2015-08-09： 厂商已经确认，细节仅向厂商公开
2015-08-19： 细节向核心白帽子及相关领域专家公开
2015-08-29： 细节向普通白帽子公开
2015-09-08： 细节向实习白帽子公开
2015-09-23： 细节向公众公开

简要描述：

中兴某站GETSHELL（任意添加管理员/任意数据库文件下载/多个后台同时沦陷/包括wiki系统等/大量API接口外漏）

详细说明：

中兴某站GETSHELL（任意添加管理员/任意数据库文件下载/多个后台同时沦陷）

QQ20150808-12@2x.png


http://www.ztesoft.com:808/zsmart/index.php


弱口令登录
admin/wenwen

QQ20150808-7@2x.png


QQ20150808-8@2x.png


抓包绕过上传限制
可shell
shell

http://www.ztesoft.com:808/upfile/20141226175700_643.php


QQ20150808-9@2x.png


QQ20150808-11@2x.png


任意添加管理员

QQ20150808-1@2x.png


数据库文件

QQ20150808-4@2x.png


QQ20150808-3@2x.png


各种敏感信息可修改

QQ20150808-6@2x.png


QQ20150808-2@2x.png


SMTP服务器

QQ20150808-5@2x.png


调查系统和访问统计链接均为其他后台，直接admin权限

QQ20150808-13@2x.png


第一处整个中兴调查系统后台，存在任意数据库文件下载

QQ20150808-10@2x.png


第二处中兴wiki系统，各种api接口...

QQ20150808-14@2x.png


QQ20150808-15@2x.png


QQ20150808-16@2x.png


QQ20150808-17@2x.png


API quick documentation
All the data in Piwik is available through simple APIs. This plugin is the web service entry point, that you can call to get your Web Analytics data in xml, json, php, csv, etc.
If you don't have data for today you can first generate some data using the VisitorGenerator plugin. You can enable the VisitorGenerator plugin, then click on the 'Visitor Generator' menu in the Piwik Admin area.
For more information about the Piwik APIs, please have a look at the Introduction to Piwik API and the Piwik API Reference .
User authentication
If you want to request data within a script, a crontab, etc. you need to add the parameter &token_auth=6cb060d199894c5411b2ec4ec9134513 to the API calls URLs that require authentication.
token_auth = 6cb060d199894c5411b2ec4ec9134513
This token_auth is as secret as your login and password, do not share it!
已成功载入 19 个 API
Module API
- API.getDefaultMetrics () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- API.getDefaultProcessedMetrics () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- API.getMetadata (idSite, apiModule, apiAction, apiParameters = 'Array') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- API.getReportMetadata (idSites = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- API.getProcessedReport (idSite, date, period, apiModule, apiAction, apiParameters = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module Actions
- Actions.getPageUrls (idSite, period, date, expanded = '', idSubtable = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Actions.getPageTitles (idSite, period, date, expanded = '', idSubtable = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Actions.getDownloads (idSite, period, date, expanded = '', idSubtable = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Actions.getOutlinks (idSite, period, date, expanded = '', idSubtable = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module ExampleAPI
- ExampleAPI.getPiwikVersion () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getAnswerToLife () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getObject () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getSum (a = '0', b = '0') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getNull () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getDescriptionArray () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getCompetitionDatatable () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getMoreInformationAnswerToLife () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- ExampleAPI.getMultiArray () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
Module Goals
- Goals.getGoals (idSite) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- Goals.addGoal (idSite, name, matchAttribute, pattern, patternType, caseSensitive = '', revenue = '') [ No example available ]
- Goals.updateGoal (idSite, idGoal, name, matchAttribute, pattern, patternType, caseSensitive = '', revenue = '') [ No example available ]
- Goals.deleteGoal (idSite, idGoal) [ No example available ]
- Goals.get (idSite, period, date, idGoal = '', columns = 'Array') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Goals.getConversions (idSite, period, date, idGoal = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Goals.getConversionRate (idSite, period, date, idGoal = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Goals.getRevenue (idSite, period, date, idGoal = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module LanguagesManager
- LanguagesManager.isLanguageAvailable (languageCode) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- LanguagesManager.getAvailableLanguages () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- LanguagesManager.getAvailableLanguagesInfo () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- LanguagesManager.getAvailableLanguageNames () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- LanguagesManager.getTranslationsForLanguage (languageCode) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- LanguagesManager.getLanguageForUser (login) [ No example available ]
- LanguagesManager.setLanguageForUser (login, languageCode) [ No example available ]
- LanguagesManager.getLanguageForSession () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- LanguagesManager.setLanguageForSession (languageCode) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
Module Live
- Live.getLastVisitForVisitor (visitorId, idSite) [ No example available ]
- Live.getLastVisitsForVisitor (visitorId, idSite, limit = '10') [ No example available ]
- Live.getLastVisits (idSite, limit = '10', minIdVisit = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- Live.getLastVisitsDetails (idSite, period = '', date = '', limit = '25', filter_offset = '0', minIdVisit = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Live.getUsersInLastXMin (idSite, minutes = '30') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- Live.getUsersInLastXDays (idSite, days = '10') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- Live.getPageImpressionsInLastXDays (idSite, days = '10') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- Live.getPageImpressionsInLastXMin (idSite, minutes = '30') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
Module PDFReports
- PDFReports.addReport (idSite, description, period, reports, emailMe = '1', additionalEmails = '') [ No example available ]
- PDFReports.updateReport (idReport, idSite, description, period, reports, emailMe = '1', additionalEmails = '') [ No example available ]
- PDFReports.deleteReport (idReport) [ No example available ]
- PDFReports.getReports (idSite = '', period = '', idReport = '', ifSuperUserReturnOnlySuperUserReports = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- PDFReports.generateReport (idReport, date, idSite = '', outputType = '', periodUsedFullReport = 'day') [ No example available ]
- PDFReports.sendEmailReport (idReport, idSite) [ No example available ]
- PDFReports.getPeriodToFrequency () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
Module Provider
- Provider.getProvider (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module Referers
- Referers.getRefererType (idSite, period, date, typeReferer = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getKeywords (idSite, period, date, expanded = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getSearchEnginesFromKeywordId (idSite, period, date, idSubtable) [ No example available ]
- Referers.getSearchEngines (idSite, period, date, expanded = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getKeywordsFromSearchEngineId (idSite, period, date, idSubtable) [ No example available ]
- Referers.getCampaigns (idSite, period, date, expanded = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getKeywordsFromCampaignId (idSite, period, date, idSubtable) [ No example available ]
- Referers.getWebsites (idSite, period, date, expanded = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getUrlsFromWebsiteId (idSite, period, date, idSubtable) [ No example available ]
- Referers.getNumberOfDistinctSearchEngines (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getNumberOfDistinctKeywords (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getNumberOfDistinctCampaigns (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getNumberOfDistinctWebsites (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- Referers.getNumberOfDistinctWebsitesUrls (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module SEO
- SEO.getRank (url) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
Module SitesManager
- SitesManager.getJavascriptTag (idSite, piwikUrl = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSiteFromId (idSite) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSiteUrlsFromId (idSite) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getAllSitesId () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesWithAdminAccess () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesWithViewAccess () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesWithAtLeastViewAccess (limit = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesIdWithAdminAccess () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesIdWithViewAccess () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesIdWithAtLeastViewAccess () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getSitesIdFromSiteUrl (url) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.addSite (siteName, urls, excludedIps = '', excludedQueryParameters = '', timezone = '', currency = '') [ No example available ]
- SitesManager.deleteSite (idSite) [ No example available ]
- SitesManager.addSiteAliasUrls (idSite, urls) [ No example available ]
- SitesManager.setGlobalExcludedIps (excludedIps) [ No example available ]
- SitesManager.getExcludedQueryParametersGlobal () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.setGlobalExcludedQueryParameters (excludedQueryParameters) [ No example available ]
- SitesManager.getExcludedIpsGlobal () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getDefaultCurrency () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.setDefaultCurrency (defaultCurrency) [ No example available ]
- SitesManager.getDefaultTimezone () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.setDefaultTimezone (defaultTimezone) [ No example available ]
- SitesManager.updateSite (idSite, siteName, urls = '', excludedIps = '', excludedQueryParameters = '', timezone = '', currency = '') [ No example available ]
- SitesManager.getCurrencyList () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getCurrencySymbols () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getTimezonesList () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- SitesManager.getPatternMatchSites (pattern) [ No example available ]
Module UserCountry
- UserCountry.getCountry (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserCountry.getContinent (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserCountry.getNumberOfDistinctCountries (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module UserSettings
- UserSettings.getResolution (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserSettings.getConfiguration (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserSettings.getOS (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserSettings.getBrowser (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserSettings.getBrowserType (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserSettings.getWideScreen (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- UserSettings.getPlugin (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module UsersManager
- UsersManager.setUserPreference (userLogin, preferenceName, preferenceValue) [ No example available ]
- UsersManager.getUserPreference (userLogin, preferenceName) [ No example available ]
- UsersManager.getUsers () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.getUsersLogin () [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.getUsersSitesFromAccess (access) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.getUsersAccessFromSite (idSite) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.getSitesAccessFromUser (userLogin) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.getUser (userLogin) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.getUserByEmail (userEmail) [ No example available ]
- UsersManager.addUser (userLogin, password, email, alias = '') [ No example available ]
- UsersManager.updateUser (userLogin, password = '', email = '', alias = '') [ No example available ]
- UsersManager.deleteUser (userLogin) [ No example available ]
- UsersManager.userExists (userLogin) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html ]
- UsersManager.userEmailExists (userEmail) [ No example available ]
- UsersManager.setUserAccess (userLogin, access, idSites) [ No example available ]
- UsersManager.getTokenAuth (userLogin, md5Password) [ No example available ]
Module VisitFrequency
- VisitFrequency.get (idSite, period, date, columns = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitFrequency.getVisitsReturning (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitFrequency.getActionsReturning (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitFrequency.getSumVisitsLengthReturning (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitFrequency.getBounceCountReturning (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitFrequency.getConvertedVisitsReturning (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module VisitTime
- VisitTime.getVisitInformationPerLocalTime (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitTime.getVisitInformationPerServerTime (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module VisitorInterest
- VisitorInterest.getNumberOfVisitsPerVisitDuration (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitorInterest.getNumberOfVisitsPerPage (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
Module VisitsSummary
- VisitsSummary.get (idSite, period, date, columns = '') [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getVisits (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getUniqueVisitors (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getActions (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getMaxActions (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getBounceCount (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getVisitsConverted (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getSumVisitsLength (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]
- VisitsSummary.getSumVisitsLengthPretty (idSite, period, date) [ Example in XML, PHP, Json, Csv, Tsv (Excel), Basic html , RSS of the last 10 days, 5 weeks, XML of the last 10 days ]


漏洞证明：

已证明

修复方案：

安全是一个整体

版权声明：转载请注明来源 Mr.Q@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2015-08-09 15:47

厂商回复：

感谢~

最新状态：

暂无

漏洞评价：

评论

  1. 2015-09-23 20:59 | 大物期末不能挂 ( 普通白帽子 | Rank:132 漏洞数:23 | 1.一个学渣，只求每门都不挂2.想把漏洞提...)

    前排

  2. 2015-09-23 22:45 | Tioyer ( 实习白帽子 | Rank:34 漏洞数:10 | 初来乍到，请各位大牛多多指教！)

    请问后台密码哪里来的？