Huawei Enterprise Information Engine SQL注入漏洞

Follow 0

Basic Fields

SSV ID:: SSV-89741

Find Time:: 2015-11-11

Submit Time:: 2015-11-16

Level:

Category:: SQL 注入

Component:

Author:: WooYun

Submitter:: Knownsec

CVE-ID：: Add

CNNVD-ID：: Add

CNVD-ID：: CNVD-2015-07447

ZoomEye Dork：: Add

Source

Detail

Unavailable Detail

PoC

Unavailable PoC

Reference Linking

http://www.cnvd.org.cn/flaw/show/CNVD-2015-07447

Solutions

Temp Solutions

Unavailable Temp Solutions

Official Solution

Unavailable Official solution

Defense Solutions

Unavailable Defense Solutions

wstart 参与了评论
Getshell 参与了评论

Timeline

WooYun

2015-11-11 发现/披露了漏洞
2015-11-16 提交了漏洞

Related Vuls

All Comments (2)

wstart 2016-09-19

= = 其实其中xxxTypeadmin参数为触发点，xxx不固定。由于wooyun上挖掘的此漏洞为中国移动与华为开发，固相关源码与参数可能有所改变。查询后发现共四处POST注入：分别是/mms/musicList.jsp下的musicByname参数，musicTypeadmin参数，picTypeadmin参数，picType参数这个不就是漏洞详情么？
Reply 0 0
2F
Getshell 2016-05-22

没有详情，怎么写poc？？
Reply 0 0
1F

※Any content provided by this site, only to learn the code and services, not for illegal purposes