图书检索系统通用SQL注射

2014-12-04T00:00:00
ID SSV:95755
Type seebug
Reporter Root
Modified 2014-12-04T00:00:00

Description

简要描述:

RT

详细说明:

北京清大新洋科技有限公司:http://www.infosea.com.cn/ 存在注入参数:flh 看案例如下: http://211.86.195.15:8086/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://211.86.225.3:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://218.241.174.148:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://61.187.55.41:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://www.kflib.cn:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://lib.tongde.com:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://58.133.216.9:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.sdwm.cn:8000/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://scsk.crsp.org.cn:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://222.27.60.13/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.ndjclib.com:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://211.84.229.10:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.ndjclib.com:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk 1.测试注入点:http://211.86.225.3:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk

<img src="https://images.seebug.org/upload/201411/30102008a7f12df28b62f838c02c13ca495e6dd5.png" alt="4.png" width="600" onerror="javascript:errimg(this);">

延迟好慢啊。 2.测试注入点:http://211.86.195.15:8086/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk

<img src="https://images.seebug.org/upload/201411/3010203767c099d49ea25db3aa207a71fe9401e1.png" alt="5.png" width="600" onerror="javascript:errimg(this);">

3.测试注入点:http://lib.tongde.com:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk

<img src="https://images.seebug.org/upload/201411/3010210222da03b44df39fd84a8202c4f81f8efa.png" alt="6.png" width="600" onerror="javascript:errimg(this);">

延迟很慢,我也就不一一的测试了。

漏洞证明:

<img src="https://images.seebug.org/upload/201411/3010210222da03b44df39fd84a8202c4f81f8efa.png" alt="6.png" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201411/3010203767c099d49ea25db3aa207a71fe9401e1.png" alt="5.png" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201411/30102008a7f12df28b62f838c02c13ca495e6dd5.png" alt="4.png" width="600" onerror="javascript:errimg(this);">