WooYun.org

厂商网站：http://www.eftimes.cn/
关键字：技术支持:天津企航
技术支持：企航互联
一处注射：view_n.asp 参数id未过滤
可读出管理员密码

Database: Microsoft_Access_masterdb
Table: admin
[7 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| author | non-numeric |
| classid | numeric |
| editor | non-numeric |
| id | numeric |
| keyword | non-numeric |
| password | non-numeric |
| username | non-numeric |
+----------+-------------+
以下提供部分案例：
http://www.dingfeng-cn.com.cn/view_n.asp?id=101
http://www.kelaosi.com/view_n.asp?id=105
http://www.tjlingchuang.com/view_n.asp?id=157
http://www.novatj.com/view_n.asp?id=84
http://www.zytkt.com/view_n.asp?id=290
http://www.tjyidian.com/view_n.asp?id=177
http://www.lzycup.com/view_n.asp?id=87
http://www.ls-zy.com/view_n.asp?id=75
http://www.sunweikeji.com/view_n.asp?id=85
http://www.richu888.com/view_n.asp?id=205
http://www.ysjq.net/view_n.asp?id=78
http://www.lipin688.com/view_n.asp?id=79
http://www.tjzubai.com/view_n.asp?id=461
http://www.tianjinyingdong.com/view_n.asp?id=72
http://www.qifanedu.com/view_n.asp?id=384
http://www.anshunxin.com/view_n.asp?id=76
http://www.tjshdk.com/view_n.asp?id=97
http://www.anshunxin.com/view_n.asp?id=75
http://www.nxrmyy.com/View_N.asp?id=977
http://www.fanucweixiu.com/view_n.asp?id=82
http://www.taihonggroup.com/view_n.asp?id=319
http://www.yehis.com/view_n.asp?id=101
http://www.tjydy.com.cn/view_n.asp?id=80
http://www.junhuadianzi.com/view_n.asp?id=79
http://www.tjsbstud.com/view_n.asp?id=77
http://www.tjsjyh.cn/view_n.asp?id=78
http://www.hkwanshida.com/view_n.asp?id=118
http://www.fanucweixiu.com/view_n.asp?id=95
http://www.beihaoshengwu.com/view_n.asp?id=107
http://www.hzasyd.net/view_n.asp?id=79
http://www.qlyingxiang.com/qlhtml/view_n.asp?id=113
http://www.dafeng-medical.com/view_n.asp?id=75
http://www.lvdanban.net/view_n.asp?id=125
http://www.tjzhineng.net/view_n.asp?id=75
http://www.tjxwhb.com/view_n.asp?id=167
http://www.sanzuobiao.net/view_n.asp?id=24&cid=4
http://www.nxfb.com/View_N.asp?id=4