漏洞详情

披露状态:

2014-08-04: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-11-02: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

某通用型系统SQL注射##6

详细说明:

百度搜索:东尚网络

20.png


关键字:inurl:shownews.asp?id=
如:
http://www2.sjzue.edu.cn/sjycjy/shownews.asp?id=56
http://www.qizhigroup.com/shownews.asp?id=208
http://www.v1687.com/shownews.asp?id=33
http://www.hnlrhb.com/shownews.asp?id=6
http://www.hengchengky.com/shownews.asp?id=467
http://www.aqgjss.com/shownews.asp?id=40
http://www.80086006.com/shownews.asp?id=179
http://www.hbhywh.com/shownews.asp?id=34
http://yanduauto.com/kairui/shownews.asp?id=29

漏洞证明:

加单引号直接报错

26.png


http://www2.sjzue.edu.cn/sjycjy/shownews.asp?id=56

21.png


http://www.qizhigroup.com/shownews.asp?id=208

22.png


http://www.v1687.com/shownews.asp?id=33

23.png


http://www.hnlrhb.com/shownews.asp?id=6

24.png


http://www.hengchengky.com/shownews.asp?id=467

25.png

修复方案:

Null

标签: none

评论已关闭