漏洞概要 关注数(2) 关注此漏洞
漏洞标题： 好生活某站存在注入泄露大量信息（11w用户）
提交时间： 2016-03-21 10:50
公开时间： 2016-05-05 10:50
漏洞类型： SQL注射漏洞
危害等级： 高
自评Rank： 15
漏洞状态： 未联系到厂商或者厂商积极忽略
漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系
Tags标签： 无
漏洞详情
披露状态：
2016-03-21： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-05-05： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
详细说明：
POST /Login.aspx?doFrom=index HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://202.101.47.116/Login.aspx?doFrom=index
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: 202.101.47.116
Content-Length: 496
Pragma: no-cache
Cookie: ASP.NET_SessionId=rqf2vmi1bqg5bjsajntalhm2; ad_play_index=68; IESESSION=alive
Connection: close
__VIEWSTATE=%2FwEPDwUKMTAyNDcwNTk2NQ9kFgJmD2QWAgIDD2QWAgIBD2QWAgIDDxYCHgRUZXh0BUw8c3BhbiBjbGFzcz0ncmVkJz7mgqjpnIDopoHnmbvlvZXlkI7miY3og73ov5vooYzmk43kvZzvvIHor7fnmbvlvZXvvIE8L3NwYW4%2BZGSaI%2Bp%2BNtwfLi30igBXJr5AuilPQdYbZ%2FX4Nnhha8OakA%3D%3D&__EVENTVALIDATION=%2FwEWBAKr1PLcAwLoksmACQKTpbW1BALQl%2FnLCLxAz9%2F%2F8h77uKkAVCl1u1lt4gPTU57SMhPFmOz%2FqsQU&ctl00%24ContentPlaceHolder%24userName=asdasd&ctl00%24ContentPlaceHolder%24passWord=sadasd&ctl00%24ContentPlaceHolder%24BtSave=%E7%99%BB%E5%85%A5
![好生活某站存在注入泄露大量信息（11w用户）]()
![好生活某站存在注入泄露大量信息（11w用户）]()
至于这个是多少信息，好多表都是数十万的
泄露用户信息
![好生活某站存在注入泄露大量信息（11w用户）]()
漏洞证明：
POST /Login.aspx?doFrom=index HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://202.101.47.116/Login.aspx?doFrom=index
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: 202.101.47.116
Content-Length: 496
Pragma: no-cache
Cookie: ASP.NET_SessionId=rqf2vmi1bqg5bjsajntalhm2; ad_play_index=68; IESESSION=alive
Connection: close
__VIEWSTATE=%2FwEPDwUKMTAyNDcwNTk2NQ9kFgJmD2QWAgIDD2QWAgIBD2QWAgIDDxYCHgRUZXh0BUw8c3BhbiBjbGFzcz0ncmVkJz7mgqjpnIDopoHnmbvlvZXlkI7miY3og73ov5vooYzmk43kvZzvvIHor7fnmbvlvZXvvIE8L3NwYW4%2BZGSaI%2Bp%2BNtwfLi30igBXJr5AuilPQdYbZ%2FX4Nnhha8OakA%3D%3D&__EVENTVALIDATION=%2FwEWBAKr1PLcAwLoksmACQKTpbW1BALQl%2FnLCLxAz9%2F%2F8h77uKkAVCl1u1lt4gPTU57SMhPFmOz%2FqsQU&ctl00%24ContentPlaceHolder%24userName=asdasd&ctl00%24ContentPlaceHolder%24passWord=sadasd&ctl00%24ContentPlaceHolder%24BtSave=%E7%99%BB%E5%85%A5
![好生活某站存在注入泄露大量信息（11w用户）]()
![好生活某站存在注入泄露大量信息（11w用户）]()
至于这个是多少信息，好多表都是数十万的
泄露用户信息
![好生活某站存在注入泄露大量信息（11w用户）]()
修复方案：
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝
漏洞Rank：15 (WooYun评价)
漏洞评价：
对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值
漏洞评价(共0人评价):
评价
评论