2015-05-31: 细节已通知厂商并且等待厂商处理中 2015-06-05: 厂商已经确认,细节仅向厂商公开 2015-06-15: 细节向核心白帽子及相关领域专家公开 2015-06-25: 细节向普通白帽子公开 2015-07-05: 细节向实习白帽子公开 2015-07-20: 细节向公众公开
一切为了手机!
工具不能跑,不知为何!还是
http://sso.ecaic.com/auth/user/registerUserAction.action
这个页面!
登陆名这里他会验证。抓包!
POST /auth/dwr/call/plaincall/VerificationUser.userExists.dwr HTTP/1.1Host: sso.ecaic.comProxy-Connection: keep-aliveContent-Length: 277Origin: http://sso.ecaic.comUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36Content-Type: text/plainAccept: */*Referer: http://sso.ecaic.com/auth/user/registerUserAction.actionAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: JSESSIONID=0B430DA670C6A8927615E7ABE4ED101DcallCount=1page=/auth/user/registerUserAction.actionhttpSessionId=0B430DA670C6A8927615E7ABE4ED101DscriptSessionId=DEB1103F407AF25C0378E10711324810243c0-scriptName=VerificationUserc0-methodName=userExistsc0-id=0c0-param0=string:yxtestc0-param1=string:userNamebatchId=0
返回的包
HTTP/1.1 200 OKServer: Apache-Coyote/1.1Content-Type: text/javascript;charset=ISO-8859-1Content-Length: 2210Date: Sat, 30 May 2015 11:00:37 GMT//#DWR-INSERT//#DWR-REPLYdwr.engine._remoteHandleException('0','0',{javaClassName:"org.springframework.jdbc.UncategorizedSQLException",message:"SqlMapClient operation; uncategorized SQLException for SQL []; SQL state [null]; error code [0]; \n--- The error occurred in com/caic/auth/entities/t_user_SqlMap.xml. \n--- The error occurred while executing query. \n--- Check the select user_code as userCode, login_name as loginName, email as email, real_name as realname, password as password,mobile_tel as mobileTel,pw_expire_date as pwExpireDate, last_visit as lastVisit, reg_ip as regIp, avatar as avatar, signature as signature, dateformat as dateformat, timeoffset as timeoffset, bio_desc as bioDesc, valid_status as validStatus, create_date as createDate, identify_type as identifyType, identify_number as identifyNumber, sex as sex ,origin_sys as originSys from t_user WHERE login_name=? . \n--- Check the SQL Statement (preparation failed). \n--- Cause: java.sql.SQLException: An attempt by a client to checkout a Connection has timed out.; nested exception is com.ibatis.common.jdbc.exception.NestedSQLException: \n--- The error occurred in com/caic/auth/entities/t_user_SqlMap.xml. \n--- The error occurred while executing query. \n--- Check the select user_code as userCode, login_name as loginName, email as email, real_name as realname, password as password,mobile_tel as mobileTel,pw_expire_date as pwExpireDate, last_visit as lastVisit, reg_ip as regIp, avatar as avatar, signature as signature, dateformat as dateformat, timeoffset as timeoffset, bio_desc as bioDesc, valid_status as validStatus, create_date as createDate, identify_type as identifyType, identify_number as identifyNumber, sex as sex ,origin_sys as originSys from t_user WHERE login_name=? . \n--- Check the SQL Statement (preparation failed). \n--- Cause: java.sql.SQLException: An attempt by a client to checkout a Connection has timed out."});
看到这个包,肯定就是注入了!
HTTP/1.1 200 OKServer: Apache-Coyote/1.1Content-Type: text/javascript;charset=ISO-8859-1Content-Length: 2210Date: Sat, 30 May 2015 11:02:31 GMT//#DWR-INSERT//#DWR-REPLYdwr.engine._remoteHandleException('0','0',{javaClassName:"org.springframework.jdbc.UncategorizedSQLException",message:"SqlMapClient operation; uncategorized SQLException for SQL []; SQL state [null]; error code [0]; \n--- The error occurred in com/caic/auth/entities/t_user_SqlMap.xml. \n--- The error occurred while executing query. \n--- Check the select user_code as userCode, login_name as loginName, email as email, real_name as realname, password as password,mobile_tel as mobileTel,pw_expire_date as pwExpireDate, last_visit as lastVisit, reg_ip as regIp, avatar as avatar, signature as signature, dateformat as dateformat, timeoffset as timeoffset, bio_desc as bioDesc, valid_status as validStatus, create_date as createDate, identify_type as identifyType, identify_number as identifyNumber, sex as sex ,origin_sys as originSys from t_user WHERE login_name=? . \n--- Check the SQL Statement (preparation failed). \n--- Cause: java.sql.SQLException: An attempt by a client to checkout a Connection has timed out.; nested exception is com.ibatis.common.jdbc.exception.NestedSQLException: \n--- The error occurred in com/caic/auth/entities/t_user_SqlMap.xml. \n--- The error occurred while executing query. \n--- Check the select user_code as userCode, login_name as loginName, email as email, real_name as realname, password as password,mobile_tel as mobileTel,pw_expire_date as pwExpireDate, last_visit as lastVisit, reg_ip as regIp, avatar as avatar, signature as signature, dateformat as dateformat, timeoffset as timeoffset, bio_desc as bioDesc, valid_status as validStatus, create_date as createDate, identify_type as identifyType, identify_number as identifyNumber, sex as sex ,origin_sys as originSys from t_user WHERE login_name=? . \n--- Check the SQL Statement (preparation failed). \n--- Cause: java.sql.SQLException: An attempt by a client to checkout a Connection has timed out."});
危害等级:低
漏洞Rank:5
确认时间:2015-06-05 08:04
根据实测情况,CNVD暂未能确认风险点,综合威胁评估,暂未列入处置流程.如后续有更有效的风险实证情况,也请白帽子继续提供
暂无