HanDs
管理员

[7月漏洞公开] 奔驰一处SQL注入泄露大量信息 



XSS都上首页了,我就看看注入能不能上!

详细说明:

http://contact.mercedes-benz.com.cn/brochure

点下一步,抓包

code 区域
POST /brochure/step2/ HTTP/1.1
Host: contact.mercedes-benz.com.cn
Content-Length: 70
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://contact.mercedes-benz.com.cn
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://contact.mercedes-benz.com.cn/brochure
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=ul66o7454t918hh2ks8n3s57m7; __utmt=1; ci_session=a%3A6%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%2210a91a67e8788c3282939fd309e6b271%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A12%3A%22218.76.52.35%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F5.0+%28Windows+NT+6.1%29+AppleWebKit%2F537.36+%28K%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1464052522%3Bs%3A8%3A%22language%22%3Bs%3A2%3A%22en%22%3Bs%3A11%3A%22FROMOUTSIDE%22%3Bs%3A12%3A%22s65l-amg-emb%22%3B%7D695dc30a665d0b8c0482a2d2bfa503aa; Hm_lvt_57598b78701bc42043be8024c2fb48e8=1464052727,1464053171; Hm_lpvt_57598b78701bc42043be8024c2fb48e8=1464053317; __utma=259003544.1090275646.1464052727.1464052727.1464053171.2; __utmb=259003544.7.10.1464053171; __utmc=259003544; __utmz=259003544.1464053171.2.2.utmcsr=baidu|utmccn=(organic)|utmcmd=organic

model%5B%5D=38&model%5B%5D=9&model%5B%5D=52&refererpage=brochure_step1



model存在注入

漏洞证明:

31.png



32.png

修复方案:

NULL


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
奔驰
#1楼
发帖时间:2016-7-9   |   查看数:0   |   回复数:0
游客组
快速回复