漏洞详情

披露状态:

2014-07-28: 细节已通知厂商并且等待厂商处理中
2014-08-02: 厂商已经确认,细节仅向厂商公开
2014-08-05: 细节向第三方安全合作伙伴开放
2014-09-26: 细节向核心白帽子及相关领域专家公开
2014-10-06: 细节向普通白帽子公开
2014-10-16: 细节向实习白帽子公开
2014-10-26: 细节向公众公开

简要描述:

没有1千个也有800个,这对于一个建站公司来说数量在国内还是不多见的

详细说明:

科创互联开发的企业建站系统SQL注入,影响网站数量过于惊人,影响数量
没有1千个也有800个,看一下截图就知道贫道没有撒谎了

QQ图片20140727143840.jpg


主要影响山东全省的企业站外带一点北京的企业站
官网:www.shandongweb.com/
漏洞涉及的注入点主要有两种
1.about.php?sortid= 这个涉及的网站最多
2.products.php? 这个相对少一点

漏洞证明:

由于这个涉及的站比较多我就多搞几个案例吧,案例搜索可以百度 “技术支持:科创互联”
案例:
http://www.qdjtx.com/about.php?sortid=6
http://www.qdhy110.com/product.php?act=list&pID=2
http://www.qdouren.com/product.php?sortID=14&pID=14&act=detail&id=34
http://www.qdaobo.cn/product.php?act=list&sortID=9
http://oukem.com/products.php?pid=61
http://huahao-china.com/products.php?sortid=6
http://www.springmagnet.com/products.php?action=detail&id=2&sortid=1
http://www.rdrq.net/about.php?sortid=8
http://www.qdkqwy.com/about.php?sortid=11
http://oukem.com/about.php?sortid=8
http://www.qdzhongze.com/about.php?sortid=9
http://www.xdl-china.com/about.php?sortID=3
http://www.rdrq.net/about.php?sortid=8
http://www.qd-credit.com/product.php?pid=6
http://www.qdmmy.com/about.php?sortid=8
http://www.haohexinxing.com/about.php?sortid=9
http://www.iso18000.net/about.php?sortID=11
http://www.qdjinding.com/product.php?action=detail&sortID=1&id=50
http://www.qdjfyjd.com/about.php?sortid=11
http://www.tianzhengjiaye.com/about.php?sortid=3
http://www.tianzhengjiaye.com/product_detail.php?id=84&sortid=18&pid=1
http://www.quannengchina.net/product.php?sortID=28&act=detail&id=37
http://www.aoshihr.com/about.php?sortid=9
http://www.weihaishanghui.com/about.php?sortid=8
http://www.bycloth.com/products.php?sortid=13
http://www.jldrlzy.com/about.php?sortid=22
http://www.langyalongwan.com/about.php?sortid=8
http://www.qdnwj.com/about.php?sortID=3
http://www.leeserbag.com/about.php?sortid=8
http://www.qddwtz.com/products.php?action=detail&id=51&sortid=4
http://www.yunshanjob.com/about.php?sortid=8
http://jhdgyp.com/about.php?sortid=7
http://www.qdgreen.cn/product.php?act=list&sortID=1
http://www.qdrc88.com/about.php?sortID=3
http://www.riyaozs.com/about.php?sortid=7
http://lanfenghuang.net/about.php?sortID=1
http://dongfangwy.net/about.php?sortid=3
http://www.hongyingwuguan.com/about.php?sortid=3
http://aohaidongxing.com/about.php?sortid=8
http://www.jadeoptic.com/about.php?sortid=7
http://www.water-green.com/about.php?sortid=8
http://www.gongfuyuan.net/about.php?sortid=7
http://www.greengiant-china.com/products.php?action=detail&id=23&sortid=1&pid=0
http://qdxcfj.com/about.php?sortID=3
http://qdhuirui.com/about.php?act=list&sortID=6
http://www.qdbast.com/about.php?sortid=15
http://www.qingdaozhuobao.com/about.php?act=list&sortID=24
http://www.qdtongxueguan.com/about.php?sortid=9
http://www.era-baby.com/about.php?sortid=7
http://www.qdaobo.cn/about.php?act=list&sortID=5
我就拿几个站来演示一下吧
http://www.qdjtx.com/about.php?sortid=6

QQ图片20140727143840.jpg


QQ图片20140727144941.jpg


QQ图片20140727144950.jpg


http://www.qdhy110.com/product.php?act=list&pID=2

QQ图片20140727145101.jpg


QQ图片20140727145101.jpg


QQ图片20140727145619.jpg


http://www.qdouren.com/product.php?sortID=14&pID=14&act=detail&id=34

QQ图片20140727145619.jpg


QQ图片20140727145850.jpg


QQ图片20140727150039.jpg


我就只演示3个站了
这个强烈要求上首页啊

修复方案:

过滤

标签: none

评论已关闭