当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-084080

漏洞标题:某期刊系统存在一处SQL注入(影响上百所国内大学)

相关厂商:西安三才科技实业有限公司

漏洞作者: 路人甲

提交时间:2014-11-24 00:57

修复时间:2015-02-22 00:58

公开时间:2015-02-22 00:58

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-11-24: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-02-22: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

RT

详细说明:

西安三才科技实业有限公司开发的期刊系统存在一处SQL注入(影响上百所国内大学) http://www.samsoncn.com/product/Customers.aspx

QQ图片20141121105338.jpg


案例:
http://www.cphc.cn/news/Details.aspx?ShortName=default&NewsId=15 __VIEWSTATE=%2FwEPDwULLTIwMjEzNjU0OTUPZBYCZg9kFghmD2QWAmYPFgIeBFRleHQFG%2BmUmeivr%2B%2B8muaWsOmXu%2BS4jeWtmOWcqOOAgmQCAw9kFgRmDxYCHwAFG%2BmUmeivr%2B%2B8muaWsOmXu%2BS4jeWtmOWcqOOAgmQCBQ9kFgICAQ9kFgJmD2QWAgIBDxYCHgtfIUl0ZW1Db3VudGZkAgQPZBYKZg9kFgICAQ8WAh4HVmlzaWJsZWdkAgEPZBYEZg8PFgIeC05hdmlnYXRlVXJsBUIuLi9vYS9vYXNjcmlwdGlzc3VlbHNpdC5hc3B4P2tpbmQ9dXBpc3N1ZSZpc3N1ZW5vbGlzdD0yMDE05bm0MDHmnJ9kZAIBDw8WAh4HRW5hYmxlZGhkZAICD2QWAgIBDxYCHwECARYCZg9kFgICAQ8PFgYfAAUM6L%2BB5Z2A6YCa55%2BlHgdUb29sVGlwBQzov4HlnYDpgJrnn6UfAwUrfi9kb2NzL2F1dGhvcnBhcmsvZGV0YWlscy5hc3B4P2RvY3VtZW50aWQ9M2RkAgMPZBYEAgEPFgIfAWZkAgMPFgIfAmhkAgQPZBYEZg8WAh8BZmQCAg8WAh8BAgQWCGYPZBYCZg8VAgEyHuOAiuS4reWbveWMu%2BmZoueuoeeQhuOAi%2BadguW%2Fl2QCAQ9kFgJmDxUCATMe44CK5Lit5Zu95Y2r55Sf57uP5rWO44CL5p2C5b%2BXZAICD2QWAmYPFQIBNBjmlrDpl7vlh7rniYjnn6Xor4blnKjnur9kAgMPZBYCZg8VAgExDOWPi%2BaDhemTvuaOpWQCBQ9kFgICAQ8PFgIfAAXcBTxwIGFsaWduPSJjZW50ZXIiPjxzcGFuIHN0eWxlPSJGT05ULVNJWkU6IDEwcHQiPjxzcGFuIHN0eWxlPSJGT05ULUZBTUlMWTog5a6L5L2TIj7lpIfmoYjvvJrpu5FJQ1DlpIcxMjAwNDIxM%2BWPtyA8L3NwYW4%2BPGEgdGl0bGU9Imh0dHA6Ly93d3cubWlpdC5nb3YuY24iIGhyZWY9Imh0dHA6Ly93d3cubWlpdC5nb3YuY24vIiB0YXJnZXQ9Il90b3AiPjxzcGFuIHN0eWxlPSJGT05ULUZBTUlMWTog5a6L5L2TIj5odHRwOi8vd3d3Lm1paXQuZ292LmNuPC9zcGFuPjwvYT48L3NwYW4%2BPHNwYW4gc3R5bGU9IkZPTlQtRkFNSUxZOiDlrovkvZM7IEZPTlQtU0laRTogMTBwdCI%2BJm5ic3A7IOeJiOadg%2BaJgOacie%2B8muS4reWbveWInee6p%2BWNq%2BeUn%2BS%2FneWBpeadguW%2Fl%2BekvuOAgDxiciAvPuiBlOezu%2BeUteivne%2B8mjA0NTEtODcyNTMwMzAmbmJzcDsvMzEvMzIg5Lyg55yf77yaMDQ1MS04NzI1MzAzMCDnlLXlrZDpgq7nrrHvvJo8L3NwYW4%2BPGEgaHJlZj0ibWFpbHRvOnBoY0B2aXAuMTYzLmNvbSI%2BPHNwYW4gc3R5bGU9IkZPTlQtRkFNSUxZOiDlrovkvZM7IEZPTlQtU0laRTogMTBwdCI%2BcGhjQHZpcC4xNjMuY29tPC9zcGFuPjwvYT48YnIgLz48c3BhbiBzdHlsZT0iRk9OVC1GQU1JTFk6IOWui%2BS9kzsgRk9OVC1TSVpFOiAxMHB0Ij5Db3B5cmlnaHQgQCAyMDA4IOilv%2BWuieS4ieaJjeenkeaKgOWunuS4muaciemZkOWFrOWPuCA8YnIgLz48cD48L3A%2BPC9zcGFuPjwvcD48cD48L3A%2BPHA%2BPC9wPmRkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBSNjdGwwMCRjcGhDb250ZWN0JE5ld3NSZW1hcmsxJGNibmlja%2FYeJnzSUmBajgLnpm9kIlON2fey&__EVENTVALIDATION=%2FwEWBgLsh%2BL2DwKTq66zCQLFh7k3AoTAoUcC%2Fe2T%2Fg0CrIrykg6N3mQUDtOde8t4u1qfKfYiGVddgQ%3D%3D&ctl00$cphContect$NewsRemark1$tbtilte=88952634&ctl00$cphContect$NewsRemark1$cbnick=on&ctl00$cphContect$NewsRemark1$upfile=88952634&ctl00$cphContect$NewsRemark1$tbcontent=88952634&ctl00$cphContect$NewsRemark1$tb_Memo_Username=88952634
http://www.zgyygl.com/news/Details.aspx?ShortName=default&NewsId=15 __VIEWSTATE=%2FwEPDwULLTIwMjEzNjU0OTUPZBYCZg9kFghmD2QWAmYPFgIeBFRleHQFhwEyMDE05bm054mI5Lit5Zu956eR5oqA5pyf5YiK5byV6K%2BB5oql5ZGK77yI5qC45b%2BD54mI77yJ77ya44CK5Lit5Zu95Yy76Zmi566h55CG44CL5p2C5b%2BX5qC45b%2BD5b2x5ZON5Zug5a2QMS4wODXvvIzlrabnp5HmjpLlkI3nrKzkuIDjgIJkAgMPZBYKZg9kFgICAQ8WAh4HVmlzaWJsZWdkAgEPZBYEZg8PFgIeC05hdmlnYXRlVXJsBUguLi9vYS9vYXNjcmlwdGlzc3VlbHNpdC5hc3B4P2tpbmQ9dXBpc3N1ZSZpc3N1ZW5vbGlzdD0yMDE05bm05q2j5YiKMTDmnJ9kZAIBDw8WAh4HRW5hYmxlZGhkZAICD2QWAgIBDxYCHgtfIUl0ZW1Db3VudAIDFgZmD2QWAgIBDw8WBh8ABQzov4HlnYDpgJrnn6UeB1Rvb2xUaXAFDOi%2FgeWdgOmAmuefpR8CBSx%2BL2RvY3MvYXV0aG9ycGFyay9kZXRhaWxzLmFzcHg%2FZG9jdW1lbnRpZD0xNWRkAgEPZBYCAgEPDxYGHwAFJ%2BOAiuS4reWbveWMu%2BmZoueuoeeQhuOAi%2BadguW%2Fl%2Bagh%2BWHhi4uLh8FBT%2FjgIrkuK3lm73ljLvpmaLnrqHnkIbjgIvmnYLlv5fmoIflh4bnvJbmjpLkvZPkvovnpLrkvovkuI7or7TmmI4fAgU2fi9VcGxvYWQvUGFyay9kMmFhYzU2Ni1mZTBjLTQwZTUtOGNhZi03NGQ2NzdmNDY3ODguZG9jZGQCAg9kFgICAQ8PFgYfAAUn44CK5Lit5Zu95Yy76Zmi566h55CG44CL5p2C5b%2BX56i%2F57qmLi4uHwUFJOOAiuS4reWbveWMu%2BmZoueuoeeQhuOAi%2BadguW%2Fl%2Beov%2Be6ph8CBTZ%2BL1VwbG9hZC9QYXJrLzlhZGVhNTAwLWI0OTUtNGMwMi1hOGUwLWMyOTUwODhkYWNhMS5kb2NkZAIDD2QWBAIBDxYCHwQCCBYQZg9kFgICAQ8PFgYfAAUlMjAxNOW5tOeJiOS4reWbveenkeaKgOacn%2BWIiuW8leivgS4uLh8FBYcBMjAxNOW5tOeJiOS4reWbveenkeaKgOacn%2BWIiuW8leivgeaKpeWRiu%2B8iOaguOW%2Fg%2BeJiO%2B8ie%2B8muOAiuS4reWbveWMu%2BmZoueuoeeQhuOAi%2BadguW%2Fl%2BaguOW%2Fg%2BW9seWTjeWboOWtkDEuMDg177yM5a2m56eR5o6S5ZCN56ys5LiA44CCHwIFFS9uZXdzL2RlZmF1bHQvMTUuYXNweGRkAgEPZBYCAgEPDxYGHwAFJTIwMTTlubTniYjkuK3lm73np5HmioDmnJ%2FliIrlvJXor4EuLi4fBQWHATIwMTTlubTniYjkuK3lm73np5HmioDmnJ%2FliIrlvJXor4HmiqXlkYrvvIjmianliIrniYjvvInvvJrjgIrkuK3lm73ljLvpmaLnrqHnkIbjgIvmnYLlv5fmianlsZXlvbHlk43lm6DlrZAxLjY2Me%2B8jOWtpuenkeaOkuWQjeesrOS4gOOAgh8CBRUvbmV3cy9kZWZhdWx0LzE0LmFzcHhkZAICD2QWAgIBDw8WBh8ABSUyMDEz54mI5Lit5Zu95a2m5pyv5pyf5YiK5b2x5ZON5ZugLi4uHwUFRTIwMTPniYjkuK3lm73lrabmnK%2FmnJ%2FliIrlvbHlk43lm6DlrZDlubTmiqXvvIgxLjQwNe%2B8jOWtpuenkeesrOS4gO%2B8iR8CBRUvbmV3cy9kZWZhdWx0LzEzLmFzcHhkZAIDD2QWAgIBDw8WBh8ABSUyMDEz5bm054mI5Lit5Zu95pyf5YiK5byV6K%2BB56CU56m2Li4uHwUFYzIwMTPlubTniYjkuK3lm73mnJ%2FliIrlvJXor4HnoJTnqbbmiqXlkYrvvJrjgIrkuK3lm73ljLvpmaLnrqHnkIbjgIvmnYLlv5fmianlsZXlvbHlk43lm6DlrZAxLjgzMOOAgh8CBRUvbmV3cy9kZWZhdWx0LzEyLmFzcHhkZAIED2QWAgIBDw8WBh8ABSUyMDEy5bm054mI5Lit5Zu95pyf5YiK5byV6K%2BB56CU56m2Li4uHwUFKDIwMTLlubTniYjkuK3lm73mnJ%2FliIrlvJXor4HnoJTnqbbmiqXlkYofAgUVL25ld3MvZGVmYXVsdC8xMS5hc3B4ZGQCBQ9kFgICAQ8PFgYfAAUlMjAxMueJiOS4reWbveWtpuacr%2Bacn%2BWIiuW9seWTjeWboC4uLh8FBUUyMDEy54mI5Lit5Zu95a2m5pyv5pyf5YiK5b2x5ZON5Zug5a2Q5bm05oql77yIMS4zNjTvvIzlrabnp5HnrKzkuIDvvIkfAgUVL25ld3MvZGVmYXVsdC8xMC5hc3B4ZGQCBg9kFgICAQ8PFgYfAAUlMjAxMeW5tOeJiOS4reWbveacn%2BWIiuW8leivgeeglOepti4uLh8FBSgyMDEx5bm054mI5Lit5Zu95pyf5YiK5byV6K%2BB56CU56m25oql5ZGKHwIFFC9uZXdzL2RlZmF1bHQvOC5hc3B4ZGQCBw9kFgICAQ8PFgYfAAUlMjAxMeeJiOS4reWbveWtpuacr%2Bacn%2BWIiuW9seWTjeWboC4uLh8FBTYyMDEx54mI5Lit5Zu95a2m5pyv5pyf5YiK5b2x5ZON5Zug5a2Q5bm05oql77yIMS4wMTHvvIkfAgUUL25ld3MvZGVmYXVsdC83LmFzcHhkZAIDDxYCHwFoZAIED2QWBGYPFgIfBAICFgRmD2QWAgIBDw8WAh8ABcYBPGEgIHJlbD0nZXh0ZXJuYWwnICBocmVmPScvQWRzQ2xpY2suYXNweD9BZHNJZD0yJyA%2BPGltZyBhbHQ9J%2BOAiuS4reWbveWNq%2BeUn%2Be7j%2Ba1juOAi%2BadguW%2Flycgc3R5bGU9J2hlaWdodDogNTVweDsgd2lkdGg6IDE5MnB4JyBzcmM9Jy9VcGxvYWQvQWRJbWFnZXMvNzVkMzRmODAtZDg0ZC00OGYyLThlYTctZGRjNTVmMzQ4ZmY3LmpwZycgLz48L2E%2BZGQCAQ9kFgICAQ8PFgIfAAXMATxhICByZWw9J2V4dGVybmFsJyAgaHJlZj0nL0Fkc0NsaWNrLmFzcHg%2FQWRzSWQ9MycgPjxpbWcgYWx0PSfjgIrkuK3lm73liJ3nuqfljavnlJ%2Fkv53lgaXjgIvmnYLlv5cnIHN0eWxlPSdoZWlnaHQ6IDU1cHg7IHdpZHRoOiAxOTJweCcgc3JjPScvVXBsb2FkL0FkSW1hZ2VzL2E0MzZjYWZkLWRhMDQtNDI2Yy05YmI2LTQzZWYwOWYxMjU1YS5qcGcnIC8%2BPC9hPmRkAgIPFgIfBAIEFghmD2QWAmYPFQIBNR3kuK3lm73ljLvpmaLnrqHnkIYtQ05LSemmlumhtWQCAQ9kFgJmDxUCATYf5Lit5Zu95Yy76Zmi566h55CGLeS4h%2BaWueaVsOaNrmQCAg9kFgJmDxUCATQY5paw6Ze75Ye654mI55%2Bl6K%2BG5Zyo57q%2FZAIDD2QWAmYPFQIBMQzlj4vmg4Xpk77mjqVkAgQPZBYKZg8WAh8ABYcBMjAxNOW5tOeJiOS4reWbveenkeaKgOacn%2BWIiuW8leivgeaKpeWRiu%2B8iOaguOW%2Fg%2BeJiO%2B8ie%2B8muOAiuS4reWbveWMu%2BmZoueuoeeQhuOAi%2BadguW%2Fl%2BaguOW%2Fg%2BW9seWTjeWboOWtkDEuMDg177yM5a2m56eR5o6S5ZCN56ys5LiA44CCZAIBDxYCHwAFETIwMTTlubQxMeaciDE45pelZAIDDxYCHwAFAjk1ZAIEDxYCHwAFngENCgkJPGRpdj4yMDE05bm054mI5Lit5Zu956eR5oqA5pyf5YiK5byV6K%2BB5oql5ZGK77yI5qC45b%2BD54mI77yJ77ya44CK5Lit5Zu95Yy76Zmi566h55CG44CL5p2C5b%2BX5qC45b%2BD5b2x5ZON5Zug5a2QMS4wODXvvIzlrabnp5HmjpLlkI3nrKzkuIDjgII8YnIgLz48L2Rpdj4NCmQCBQ9kFgICAQ9kFgJmD2QWAgIBDxYCHwRmZAIFD2QWAgIBDw8WAh8ABecEPHAgYWxpZ249ImNlbnRlciI%2BPHNwYW4gc3R5bGU9IkxJTkUtSEVJR0hUOiAxODAlIj48c3BhbiBzdHlsZT0iRk9OVC1TSVpFOiAxMHB0Ij48c3BhbiBzdHlsZT0iRk9OVC1GQU1JTFk6IOWui%2BS9kyI%2B5aSH5qGI77ya6buRSUNQ5aSHMTIwMDQyMTPlj7cgPC9zcGFuPjxhIHRpdGxlPSJodHRwOi8vd3d3Lm1paXQuZ292LmNuIiBocmVmPSJodHRwOi8vd3d3Lm1paXQuZ292LmNuLyIgdGFyZ2V0PSJfdG9wIj48c3BhbiBzdHlsZT0iRk9OVC1GQU1JTFk6IOWui%2BS9kyI%2BaHR0cDovL3d3dy5taWl0Lmdvdi5jbjwvc3Bhbj48L2E%2B44CAPC9zcGFuPjxzcGFuIHN0eWxlPSJGT05ULUZBTUlMWTog5a6L5L2TOyBGT05ULVNJWkU6IDEwcHQiPueJiOadg%2BaJgOacie%2B8muS4reWbveWMu%2BmZoueuoeeQhuadguW%2Fl%2BekvuOAgDxiciAvPuiBlOezu%2BeUteivne%2B8mjA0NTEtODcyNTMwMjAg5Lyg55yf77yaMDQ1MS04NzI1MzAyOe%2B8jDg3MjUzMDIwIOeUteWtkOmCrueuse%2B8mjwvc3Bhbj48YSBocmVmPSJtYWlsdG86Y2htQHZpcC4xNjMuY29tIj48c3BhbiBzdHlsZT0iRk9OVC1GQU1JTFk6IOWui%2BS9kzsgRk9OVC1TSVpFOiAxMHB0Ij5jaG1AdmlwLjE2My5jb208L3NwYW4%2BPC9hPjwvc3Bhbj48L3A%2BZGQYAQUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFI2N0bDAwJGNwaENvbnRlY3QkTmV3c1JlbWFyazEkY2JuaWNrcp9M%2BXjwM7Hv1m1xALYYkOH9Ias%3D&__EVENTVALIDATION=%2FwEWBgKwyvnjBQKTq66zCQLFh7k3AoTAoUcC%2Fe2T%2Fg0CrIrykg7KvVqd3QpEkFCF7zk%2F2lSvISSIeA%3D%3D&ctl00$cphContect$NewsRemark1$tbtilte=2014%D0%B9%C6%BC%DA%BF%D6%A4%E6%A3%A8%C4%B0%E6%A3%A9%D0%B9%D2%BD%D4%BA%D6%BE%D3%B01.085%D1%A7%D2%BB&ctl00$cphContect$NewsRemark1$cbnick=on&ctl00$cphContect$NewsRemark1$upfile=88952634&ctl00$cphContect$NewsRemark1$tbcontent=88952634&ctl00$cphContect$NewsRemark1$tb_Memo_Username=88952634
http://www.cn-he.cn/News/Details.aspx?ShortName=default&NewsId=9 __VIEWSTATE=%2FwEPDwULLTIwMjEzNjU0OTUPZBYCZg9kFghmD2QWAmYPFgIeBFRleHQFDOi%2FgeWdgOmAmuefpWQCAw9kFgpmDxYCHwAFDOi%2FgeWdgOmAmuefpWQCAQ8WAh8ABREyMDE05bm0MTDmnIgxOeaXpWQCAw8WAh8ABQM1MzlkAgQPFgIfAAX6AyZuYnNwOzxiciAvPjxzcGFuIHN0eWxlPSJDT0xPUjogIzAwMDBmZiI%2BPHNwYW4gc3R5bGU9IkZPTlQtU0laRTogMTRwdCI%2B5Lit5Zu95Yy76Zmi566h55CG5p2C5b%2BX56S%2B6IeqMjAxNOW5tDEw5pyIMjDml6Xotbfov4Hoh7PmlrDnmoTlip7lhazlnLDngrnjgIIgPGJyIC8%2B5Zyw44CA44CA5Z2A77ya5ZOI5bCU5ruo5biC6aaZ5Z2K5Yy65Yac5Zy66KGXMzDlj7cxMOalvCA8YnIgLz7pgq7mlL%2FnvJbnoIHvvJoxNTAwMzAgPGJyIC8%2B44CK5Lit5Zu95Y2r55Sf57uP5rWO44CL57yW6L6R6YOo6YCa6IGU5pa55byP5pyq5Y%2BY44CC5Zug55S16K%2Bd6L%2BB56e75bCa6ZyA5pe25pel77yM5Zyo5q2k5pyf6Ze06K%2B35ZCE5L2N5L2c6ICF6YCa6L%2BH5oiR5YiK56i%2F5Lu26YeH57yW572R56uZ5LiO57yW6L6R6YOo5Lq65ZGY6L%2Bb6KGM6IGU57O744CC5b6F55S16K%2Bd6L%2BB56e75a6M5oiQ5ZCO77yM5oiR5YiK5bCG5Y%2BK5pe25Zyo572R56uZ5Y%2BR5biD5raI5oGv44CCPC9zcGFuPiA8YnIgLz48L3NwYW4%2BZAIFD2QWAgIBD2QWAmYPZBYCAgEPFgIeC18hSXRlbUNvdW50AgYWDGYPZBYCZg8VBAzlj5Hnpajlkqjor6IIZGlhbnpob3UTMjAxNC8xMC8yMCAxMDo1NjowNqYB6LS156S%2B5oKo5aW977yM5oiR5Lus56i%2F5Y%2B35Li6MTIwMTQwODA2M%2BeahOaWh%2BeroOW3suaOpeWPl%2B%2B8jOS9huaYr%2Bi9rOi0puaXtuW%2FmOS6huWGmeeov%2BWPt%2BS4juS9nOiAheWnk%2BWQje%2B8jOivt%2BmXrui0teekvuiDveWQpuehruiupOW5tue7meS4juWPkeelqOWRou%2B8n%2BmdnuW4uOaEn%2BiwomQCAQ9kFgJmDxUEDOivgeaYjuadkOaWmQblkLTnhJUTMjAxNC8xMC8yNCAxMzoxMjo0MqcE5oKo5aW977yaDQogICAgICAg5oiR5piv5paw5Lmh5Yy75a2m6Zmi566h55CG5a2m6Zmi55qE5ZC054SV77yM5oiR57yW5Y%2B35Li6IA0KDQoNCjEyMDE0MDQxMDQNCiANCuays%2BWNl%2BecgeS5oemVh%2BWNq%2BeUn%2BmZouWNq%2BeUn%2Bi1hOa6kOWIqeeUqOaViOeOh%2BWIhuaekO%2B8muWfuuS6jkRFQeaWueazlQ0KDQrnmoTmlofnq6DooqvotLXmnYLlv5fnpL7lvZXnlKjvvIzlt7Lnu4%2FlronmjpLniYjmnJ%2FjgILlm6DkuLrov5nnr4fmlofnq6DmmK%2FmiJHkuLvmjIHnmoTkuIDkuKrnnIHova%2Fnp5Hlrabpobnnm67nmoTkuK3mnJ%2FmiJDmnpzvvIznjrDlnKjmiJHlh4blpIfnu5PpobnvvIzlj6%2FmmK%2Flm6DkuLrmnYLlv5flh7rniYjlkoznu5PpobnmnInml7bpl7Tlt67vvIzluIzmnJvotLXnpL7og73nu5nmiJHmj5DkvpvkuIDkuKror4HmmI7mnZDmlpnvvIznlLHkuo7otLXnpL7ov4HlnYDvvIzkuIDnm7Tml6Dms5XmiZPpgJrnlLXor53vvIzmiJHnmoTnlLXor53mmK8xNTAzNzMzOTYxOO%2B8jOaIkeeahOmCrueuseaYr3d1aHVhbjUyMUBzb2h1LmNvbS7mnJ%2FlvoXmgqjnmoTlm57kv6FkAgIPZBYCZg8VBBLniYjpnaLotLnnmoTlj5HnpagMZnlzcGVjaWFsMTY4EzIwMTQvMTEvMTMgMTA6NDA6MzHlAue8lui%2BkeaCqOWlve%2B8geeov%2BWPt%2B%2B8mjEyMDE0MDcwNTbkuIDmlocxMeaciOWNs%2BWwhuWIiuWHuu%2B8jOS9huacrOaWhzE4MDDlhYPniYjpnaLotLnnmoTlj5Hnpajov5jmnKrmlLbliLDvvIzkvaDku6znlLXor53kuZ%2FkuIDnm7TmsqHkurrmjqXvvIzor7fpl67kvaDku6zmmK%2FlkKblr4Tlh7rvvJ%2FmiJHnmoTpgJrkv6HlnLDlnYDmmK%2FvvJrotLXlt57pgbXkuYnluILlpKfov57ot68yMDHlj7fpgbXkuYnljLvlrabpmaLnrqHnkIblrabpmaLljavnlJ%2Fnu4%2FmtY7mlZnnoJTlrqTvvIzmlLbkv6HkurrvvJrlhq%2Fmr4XvvIznlLXor53vvJoxODA3NjI2MzkyNe%2B8jOmCrueuse%2B8mmZ5c3BlY2lhbDE2OEBzaW5hLmNvbeiwouiwou%2B8gWQCAw9kFgJmDxUEMeeov%2BWPt%2B%2B8mjEyMDE0MTAwNzfkuIDmlofvvIzlrqHnqL%2Fov5vluqblkqjor6LvvIEGaHVqdzk5EzIwMTQvMTEvMTMgMTc6MDM6MjWVAue8lui%2BkeaCqOWlve%2B8muaIkeS6jjIwMTTlubQxMOaciDE25pel77yM5oqV56i%2F6LS15YiK6K665paH5LiA56%2BH77yB56i%2F5Y%2B3MTIwMTQxMDA3N%2B%2B8jOW3suWIsOaUtueov%2BmAmuefpe%2B8jOS9huaYr%2BWIsOebruWJjeS4uuatouezu%2Be7n%2BS4gOebtOaYvuekuuetieW%2BheWIneWuoe%2B8geaDs%2BWSqOivouS4gOS4i%2B%2B8jOaYr%2BWQpuWHuueOsOS6humXrumimO%2B8geebvOWbnuWkje%2B8geiBlOezu%2BaWueW8j%2B%2B8mkVtYWlsOmh1anc5OUAxNjMuY29tIFRFTDoxNTA2NDYzNjM1OCznpZ3lpb3vvIFkAgQPZBYCZg8VBA%2FniYjpnaLotLnlj5HnpagMeWFiaW5nX3poYW5nEzIwMTQvMTEvMTQgMTA6MDY6NDe3Aeeov%2BWPtzEyMDE0MDkwMTTjgIExMjAxMzA5MDcx44CBMTIwMTMwMjAwM%2BeahOWPkeelqOiHs%2BS7iuacquaUtuWIsO%2B8jOWPkemAgeS%2FoeaBr%2BayoeacieWbnuWkje%2B8jOeUteivneWPiOaXoOazleiBlOezu%2B%2B8jOi0ouWKoeimgeWFs%2BW4kOS6hu%2B8jOmdnuW4uOedgOaApe%2B8jOivt%2BWwveW%2Fq%2BWvhOWHuu%2B8jOaLnOaJmO%2B8gWQCBQ9kFgJmDxUED%2BeJiOmdoui0ueWPkeelqAx5YWJpbmdfemhhbmcTMjAxNC8xMS8xNCAxMDowNzoxM7cB56i%2F5Y%2B3MTIwMTQwOTAxNOOAgTEyMDEzMDkwNzHjgIExMjAxMzAyMDAz55qE5Y%2BR56Wo6Iez5LuK5pyq5pS25Yiw77yM5Y%2BR6YCB5L%2Bh5oGv5rKh5pyJ5Zue5aSN77yM55S16K%2Bd5Y%2BI5peg5rOV6IGU57O777yM6LSi5Yqh6KaB5YWz5biQ5LqG77yM6Z2e5bi4552A5oCl77yM6K%2B35bC95b%2Br5a%2BE5Ye677yM5ouc5omY77yBZAIED2QWCGYPZBYCAgEPFgIeB1Zpc2libGVnZAIBD2QWBGYPDxYCHgtOYXZpZ2F0ZVVybAVFLi4vb2Evb2FzY3JpcHRpc3N1ZWxzaXQuYXNweD9raW5kPXVwaXNzdWUmaXNzdWVub2xpc3Q9MjAxNOW5tOesrDEw5pyfZGQCAQ8PFgIeB0VuYWJsZWRoZGQCAw9kFgICAQ8WAh8BAgQWCGYPZBYCAgEPDxYGHwAFKuOAiuS4reWbveWNq%2BeUn%2Be7j%2Ba1juOAi%2BadguW%2Fl%2Be8luaOkuinhC4uLh4HVG9vbFRpcAUz44CK5Lit5Zu95Y2r55Sf57uP5rWO44CL5p2C5b%2BX57yW5o6S6KeE6IyD77ya5YiK5L6LHwMFNn4vVXBsb2FkL1BhcmsvMGUxN2Y3ODctNDViNi00ZjE4LWI0MjEtYmFlNjlkNjk1ZjQ4LmRvY2RkAgEPZBYCAgEPDxYGHwAFKuS%2BneaNruaWh%2BeroOexu%2BWei%2BinhOiMg%2BaSsOWGmeWSjOWuoee8li4uLh8FBS3kvp3mja7mlofnq6Dnsbvlnovop4TojIPmkrDlhpnlkozlrqHnvJbnqL%2Fku7YfAwU2fi9VcGxvYWQvUGFyay9hMzc5NTIyZS1jZTVkLTQ0YWMtYWUxMS03ODdiYmYxM2JiN2MucGRmZGQCAg9kFgICAQ8PFgYfAAUb5aaC5L2V5L%2Bd6K%2BB5oqV56i%2F5oiQ5Yqf77yfHwUFG%2BWmguS9leS%2FneivgeaKleeov%2BaIkOWKn%2B%2B8nx8DBSt%2BL2RvY3MvYXV0aG9ycGFyay9kZXRhaWxzLmFzcHg%2FZG9jdW1lbnRpZD00ZGQCAw9kFgICAQ8PFgYfAAUq44CK5Lit5Zu95Y2r55Sf57uP5rWO44CL5p2C5b%2BX5q2j5byP5byALi4uHwUFReOAiuS4reWbveWNq%2BeUn%2Be7j%2Ba1juOAi%2BadguW%2Fl%2Bato%2BW8j%2BW8gOmAmuWcqOe6v%2BaKleeov%2BOAgeafpeeov%2Bezu%2Be7nx8DBSt%2BL2RvY3MvYXV0aG9ycGFyay9kZXRhaWxzLmFzcHg%2FZG9jdW1lbnRpZD0zZGQCBA9kFgRmDxYCHwFmZAICDxYCHwECDBYYZg9kFgJmDxUCATQq5Lit5Y2O5Lq65rCR5YWx5ZKM5Zu95Zu95a625Y2r55Sf5ZKM6K6hLi4uZAIBD2QWAmYPFQICMTEq5Lit5Y2O5Lq65rCR5YWx5ZKM5Zu95paw6Ze75Ye654mI5oC7572yLi4uZAICD2QWAmYPFQIBNRjkuK3lm73ljavnlJ%2Fnu4%2FmtY7lrabkvJpkAgMPZBYCZg8VAgE2KuWNq%2BeUn%2BmDqOWNq%2BeUn%2BWPkeWxleeglOeptuS4reW%2Fg%2B%2B8iOWOny4uLmQCBA9kFgJmDxUCAjEyFem7kem%2Bmeaxn%2BecgeWNq%2BeUn%2BWOhWQCBQ9kFgJmDxUCAjEzKum7kem%2Bmeaxn%2BecgeaWsOmXu%2BWHuueJiOWxgO%2B8iOeJiOadg%2BWxgC4uLmQCBg9kFgJmDxUCATcb5Lit5Zu95Yy76Zmi566h55CG5p2C5b%2BX56S%2BZAIHD2QWAmYPFQIBMyTkuIfmlrnmlbDmja7lupPvvJrkuK3lm73ljavnlJ%2Fnu4%2FmtY5kAggPZBYCZg8VAgEyI0NOS0k644CK5Lit5Zu95Y2r55Sf57uP5rWO44CL5p2C5b%2BXZAIJD2QWAmYPFQIBOSNDTktJOuOAiuS4reWbveWNq%2BeUn%2Bi1hOa6kOOAi%2BadguW%2Fl2QCCg9kFgJmDxUCAjEwJ0NOS0k644CK5Zu95aSW5Yy75a2mLuWNq%2BeUn%2Be7j%2Ba1juWIhi4uLmQCCw9kFgJmDxUCAjE1GOaWsOmXu%2BWHuueJiOefpeivhuWcqOe6v2QCBQ9kFgICAQ8PFgIfAAW8BDxkaXYgYWxpZ249ImNlbnRlciI%2BPHNwYW4gc3R5bGU9IkZPTlQtU0laRTogMTBwdCI%2B5aSH5qGI77ya6buRSUNQ5aSHMTIwMDQyMTPlj7cgPGEgaHJlZj0iaHR0cDovL3d3dy5taWl0Lmdvdi5jbi8iPmh0dHA6Ly93d3cubWlpdC5nb3YuY248L2E%2BICZuYnNwO%2BeJiOadg%2BaJgOacie%2B8muS4reWbveWNq%2BeUn%2Be7j%2Ba1juadguW%2Fl%2BekviZuYnNwOyZuYnNwOzxiciAvPueUteivnS%2FkvKDnnJ%2FvvJowNDUxLTg3MjUzMDQwJm5ic3A7Jm5ic3A755S15a2Q5L%2Bh566x77yaPC9zcGFuPjxhIGhyZWY9Im1haWx0bzp6Z3dzamoxOTgyQDE2My5jb20iPjxzcGFuIHN0eWxlPSJGT05ULVNJWkU6IDEwcHQiPno8L3NwYW4%2BPC9hPjxzcGFuIHN0eWxlPSJGT05ULVNJWkU6IDEwcHQiPjxhIGhyZWY9Im1haWx0bzp6Z3p3c2pqMTg4MkAxNjMuY29tIj48c3BhbiBzdHlsZT0iRk9OVC1TSVpFOiAxMHB0Ij5nPC9zcGFuPjwvYT48YSBocmVmPSJtYWlsdG86emd3c2pqMTk4MkAxNjMuY29tIj53c2pqMTk4MkAxNjMuY29tPC9hPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86emd3c2pqMTk4MkAxNjMuY29tIj48L2E%2BPGJyIC8%2BPC9kaXY%2BZGQYAQUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFI2N0bDAwJGNwaENvbnRlY3QkTmV3c1JlbWFyazEkY2JuaWNrJYbKq9bcN41ag919nDsn5q76uUU%3D&__EVENTVALIDATION=%2FwEWBgKR5%2BmWAgKTq66zCQLFh7k3AoTAoUcC%2Fe2T%2Fg0CrIrykg7PxI0fEL6c6JZOC9BNZMaU55YQVg%3D%3D&ctl00$cphContect$NewsRemark1$tbtilte=%C7%A8%D6%B7%CD%A8%D6%AA&ctl00$cphContect$NewsRemark1$cbnick=on&ctl00$cphContect$NewsRemark1$upfile=88952634&ctl00$cphContect$NewsRemark1$tbcontent=88952634&ctl00$cphContect$NewsRemark1$tb_Memo_Username=88952634

漏洞证明:

我就只演示1个站了
http://www.cn-he.cn/News/Details.aspx?ShortName=default&NewsId=9

QQ图片20141121105522.jpg

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝