乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-01-10: 细节已通知厂商并且等待厂商处理中 2016-01-14: 厂商已经确认,细节仅向厂商公开 2016-01-24: 细节向核心白帽子及相关领域专家公开 2016-02-03: 细节向普通白帽子公开 2016-02-13: 细节向实习白帽子公开
http://**.**.**.**:7001/gx-eams/NetService/ExternService/Apply/CompExam/Apply_CompExamSign_selectExam.jsp?isNewSign=true 广西财政会计网,存在反序列命令执行,通过写shell,配置数据库发现近5000W的各类数据,主要是200W的从业者信息,主要包括个人详细信息以及考试信息。数据过于庞大,只给出部分证明,
<jdbc-driver-params> <url>jdbc:oracle:thin:@**.**.**.**:1521:eams</url> <driver-name>oracle.jdbc.OracleDriver</driver-name> <properties> <property> <name>user</name> <value>gxeams</value> </property> </properties> <password-encrypted>{AES}4RWzxt1GWGmTgN0fvXxjMvVVCUWONBLVqzIeZ1RvUR8=</password-encrypted>kj0815
数据库配置及破解的密码
http://**.**.**.**:7001/gx-eams/Css/2.jspx 9635789
Query#0 : select t.TABLE_NAME,t.NUM_ROWS from user_tables t order by NUM_ROWS descTABLE_NAMEVARCHAR2 NUM_ROWSNUMBERBASE_ACCOUNTANT_INFO_TRACE 5179324SYS_LOG 2818686NET_EXAM_GRADE 2459872EXAM_GRADE 2400720NET_ACCOUNTANT_DATA 2267285BASE_TECHAPPLY_SUBJECT 2247516COMP_APPLY_COUNT 1699123NET_ACCOUNTANT_APPLY 1534609GRADE_TEMP2 937089NET_ACCOUNTANT_APPLY_AUDIT 885325NET_INFO_CHANGE_DETAILS 823952NET_EXAM_SIGN_DATA 741625BASE_ACCOUNTANT_DATA 733383EXAM_SIGN_DATA 710899EXTRA_PAY 683460ACCOUNTANT_EDU 634235PAY_TRANSACTION 620871COMP_ACCOUNTANT_DATA 533462TZC 457122BASE_ACCOUNTANT_DATA_TEMP 392348COMP_ACCOUNTANT_DATA_BAK 391798NET_SIGN_ACCOUNT 359124EXAM_GRADE_TEMP 336940ACCOUNTANT_CHANGE 264078ORGAN_ENTERPRISE 253529ACCOUNTANT_BASE 245684OPERATION_LOG 168026BASE_ACCOUNTANT_APPLY 158323TB_EDU_ACC_SIGN_INFO 147792TB_ACCOUNT_EDU_BASE_INFO 141425TB_EDU_LOG_INFO 141418EXAM_SIGN_DATA_BAK 126214ACCOUNTANT_NOTE 123379BASE_COMPID_BACKUP 120542TB_EDU_SERVICE_INFO 90931EXAM_CLASSROOM_SEAT 83537ACCOUNTANT_BASE_BAK20110630 70046SYS_ROLE_FUNCTION_RIGHT 47698ACCOUNTANT_MIGRATE 35127TB_TEMP_ORDERID 31741ACCOUNTANT_BASE_BACKUP 30050BASE_ACCOUNTANT_APPLY_AUDIT 29821BASE_CERT_PRINT_CONF 21572SYS_FTP_LOG 17835EXAM_TESTSCENE 13898COMP_ACCOUNTANT_DATA_BASE 10972COMP_ACCOUNTANT_DATA_TEMP_ACC 10972BASE_ACCOUNTANT_DATA_MOVEOUTED 9874ONLY_MOVEOUTED 7850OLD_BASE_ACCOUNTANT_INFO_TRACE 7420BASE_CHINESE_SPELL 6725EMAIL_QUEUE 5620SYS_EXPORT_SCHEMA_02 4932EXAM_ACCEPT_DATE_PLAN 4813NET_SCHOOL_DATA 4744BASE_COUNTRY_ADMIN 4169TB_EDU_STUTY_CARD 4000CHANGE_PHOTO_HISTORY 3822SYS_EXPORT_SCHEMA_01 3638COMP_ACCOUNTANT_DATA_UNMOVE 2822EXAM_TESTSCENE_BAK 2567QUIZ_USER_QUESTION 2165SYS_USER_ROLE 1942SYS_FUNCTION 1699REPORT_SETTING 1692EXAM_CLASSROOM 1556SPECIAL_CHANGE 1395BASE_WORKDAY 1284OLD_COMP_ACCOUNTANT_DATA 1147OLD_BASE_ACCOUNTANT_DATA 1133ACCOUNTANT_REWARD 942OLD_ORGAN_ENTERPRISE 913BASE_DATA_DICT 902ACCOUNTANT_PUNISH 869COM_ACCOUNTANT_HORTATION 806COM_ACCOUNTANT_PUNISH 782TEMP1 677TEMP2 677SYS_USER 606WORKFLOW_STEP_CONF 510SYS_ROLE 505BASE_SEQ 446ORGAN_DATA 397SYS_CONFIGED_PARAM 367GRADE_TEMP1 301GRADE_TEMP4 301GRADE_TEMP3 301GRADE_TEMP 301EXAM_NODE 278EXAM_MAIN_ADMIN_CONF 239BASE_ADMIN 140NET_CLASS 140TB_EDU_PAY_ACCOUNT 101EXAM_CODE_MAPPING 99COMP_CERTIFICATE 98BASE_INFO_MODIFY 90EXAM_SUBJECT_CONF 85PUNISH_MAINTENANCE 77SYS_USER_PARAM 58BASE_NATION 57RESET_PASS_PERCENT 53BASE_APPLY_ERROR 51EXAM_MAIN 34BASE_CERT_PRINT_ELE 30T_INTF_COMMON_CODE_SEQ 29SYS_PARAMETER 28PAY_ACCOUNT 22SBQ_AUDIT 20BASE_APPLY_TYPE 20BASE_RULE_EXPRE 19SBQ_PERSONINFO 18SBQ_DUTAM 17NET_APPLY_TYPE 16SBQ_TASK_CLASS 15SYS_BANK_FTP_SERVER 15AGENT_TRAN_TYPE 15BASE_OPER_TIME 14COMP_TEACH_SUBJECT 13COMP_TEACH_SUBJECT_CONF 13SBQ_TASK 12BASE_ACCOUNTANT_WORK 12SYSUSERFUN 12TB_EDU_YEARS 11SYSFUNCTION 11BASE_ECONOMY_TYPE 10SBQ_DUTAM_SCORE 10NET_CLASS_SHOW 10SBQ_SIGNUP 10ACCOUNT_AGENT_CHANGE_TYPE 9SBQ_EXAM 9SBQ_GRADE 9BASE_EDU 8BASE_MAJOR 8BASE_RECK_GRADE 8GSCPROJBASICINFO 7BASE_TECH_DUTY 7BASE_LEARNING_DUTY 7TOUCHTYPE 6SBQ_DUTAM_TYPE 6BASE_DUTY 6BASE_JOB 6EXAM_LEVEL 6EXAM_QUESTION_DIFFICULTY 6EXAM_SUBJECT 6WORKFLOW_STEP 5BASE_OPERATION_TYPE 5WORKFLOW_PROC 5MESSAGE_QUEUE 5BASE_TECH_COMP 5BASE_AUDIT 5BASE_FL 5EXAM_QUESTION_TYPE 5EXAM_TYPE 5BASE_POLITY 4BASE_HYLX 4UNACCOUNTANT_TYPE 4TB_EDU_SCHOOL_INFO 4OTHER_CERT 4NET_NEW_TYPE 4EXAM_QUESTION_VERSION 4BASE_UNIT_TYPE 4BASE_TECH_COMP_MODE 4BASE_PLACE_TYPE 4BASE_OFFICE_BUILD 4TB_WEDU_ACCEPT 4TB_WEBEDU_COUNT 4TB_EDU_NET_KEY 4TB_EDU_LESSON_INFO 4TB_EDU_LESSON_AREA 4BASE_WORD 4BASE_SLT 4BASE_WEDDING 3BASE_GRADE_TYPE 3BASE_USER_TYPE 3SYS_MODULE_TYPE 3BASE_SEX 3BASE_HEALTH 3BASE_REPORT_TYPE 3BASE_NATIONALITY 3BASE_OPERATION_CHAR 3BASE_ARCSTATE 3SBQ_CLASS 3BASE_ELE_GRADE 3SBQ_ARC_DUTAM 3NET_UNIT_CHANGE_APPLY 2SBQ_ARC_BEFORE_DUTAM 2BASE_CERT_TYPE 2SBQ_ARC_AFTER_DUTAM 2SYSUSER 2SBQ_INTERVIEW_GRADE 2BASE_UNIT_LEVEL 2EXAM_BOOK_CONF 2TB_EDU_AUDIT_INFO 2BASE_CHECK_TYPE 2EXAM_BOOK 1SBQ_ARC 1SBQ_ARC_AFTER 1SBQ_ARC_BEFORE 1SBQ_INTERVIEW 1SBQ_TASKSUBMIT 1SBQ_TASK_PEOPLRS 1NET_USER_TYPE 1BASE_ACCOUNTANT_DATA_INFO 1WS_PASSWORD 1FIXED_FEE 1SYS_EXAM_PARAM_CONF 1NET_USER 1EXAM_YEARMONTH_CONF 0IMPORT_EXAM_GRADE 0IMP_APPEAR_LIST 0IMP_DETACHBAG_LIST 0IMP_EXP_LIST 0IMP_EXP_SEQ 0NET_CLASS_DETAIL 0NET_DATA_RIGHT 0NET_EXAM_BUYJOIN_BOOK 0NET_EXAM_GRADE_TEMP 0NET_EXAM_GROUP_CONF 0NET_FUNCTION 0NET_FUNCTION_TYPE 0NET_FUNCTION_TYPE_CONF 0NET_NEW 0NET_UNIT_RECORD_APPLY 0PLAN_TABLE 0QUERY_COMP_ACCOUNTANT_DATA 0QUERY_EXAM_GRADE 0QUERY_EXAM_SIGN_DATA 0SYS_USER_DATA_RIGHT 0SYS_USER_FUNCTION 0TOUCHPIC 0TOUCHTITILE 0UNIT_COMP_APPLY 0WORKFLOW_AUDIT 0QUIZ_KEYWORD 0QUIZ_QUESTION_CONF 0QUIZ_BASE_QUESTION 0QUIZ_TYPE 0PAY_TRANSACTION_EXCEPTION 0AGENT_YEAR_TIMER 0ACCOUNT_AGENT_CO 0ACCOUNT_AGENT_APPLY 0ACCOUNT_AGENT_APPLY_AUDIT 0ACCOUNT_AGENT_CO_MAN 0ACCOUNT_AGENT_ADJUNCT 0ACCOUNT_AGENT_YEAR 0ACCOUNT_AGENT_YEAR_APPLY 0ACCOUNT_AGENT_YEAR_COPARTNER 0ACCOUNT_AGENT_YEAR_PERSONNEL 0ACCOUNT_AGENT_RESISSUE_AUDIT 0ACCOUNT_AGENT_CHANGE_LOG 0ACCOUNT_AGENT_LOGOUT_APPLY 0ACCOUNT_AGENT_RESISSUE_APPLY 0BASE_CONT_TEACH_ORGAN 0CONT_TEACH_CLASS_TEACHERINFO 0CONT_TEACH_CLASS_INFO 0BASE_TEACHERINFO_CONF 0NET_SCHOOL_INFO 0BASE_CONTINUE_TEACH_INFO 0ACCOUNT_AGENT_YEAR_RECORD 0SBQ_ARCCHANGE 0SBQ_INTERVIEWER 0SBQ_SBQEXAM_SIGN 0SYS_BANK_TRADE_INFO 0CONT_TEACH_CLASS_SUBJECT_CONF 0CONT_TEACH_CLASS_SUBJECTINFO 0TB_ARCH_APPLY_INFO 0TB_ARCH_CERT_USED_INFO 0TB_ARCH_TOTAL_INFO 0TB_EDU_FACE_SCORE_INFO 0TB_FACE_EDU_SCHOOL_INFO 0ADMIN_AUDIT_BZ 0ADMIN_INTER_LOG 0AD_CREDIT_DATA_DETAIL 0AD_CREDIT_DATA_MAIN 0AGENT_ACCOUNTANT_DATA 0AGENT_ACCOUNTANT_INFO 0AGENT_BASE 0AGENT_CHECK 0AGENT_CLIENT 0AGENT_CLIENT_DATA 0AGENT_CLIENT_IDEA 0AGENT_CO 0AGENT_CO_MODIFY 0AGENT_CO_YEAR 0AGENT_CO_YEAR_DETAIL 0AGENT_IDEA_TYPE 0AGENT_IDEA_YEAR 0AGENT_LOGOUT 0AGENT_MAN_INFO 0AGENT_OUT 0AGENT_YEAR 0BAK_ACCOUNTANT_DATA 0BAK_ACCOUNTANT_INFO_TRACE 0BAK_COMP_ACCOUNTANT_DATA 0BASE_ACCOUNTANT_APPLY_POST 0BASE_ACCOUNTANT_ID_HISTORY 0BASE_ACCOUNTANT_POSTPONED 0BASE_APPLY_ERROR_CONF 0BASE_EVALUATE_TYPE 0BASE_ORGAN_INFO_TRACE 0BASE_REG_MODE 0BASE_REPORT_CONF 0BASE_RULE_ELE 0BASE_TRADE 0BASE_TRADE_TYPE 0BASE_UNIT_NUM 0BASE_WORK_TEACH 0COMP_CERT_TEMP 0COM_ACCOUNTANT_AUDIT 0CONT_TEACH_CLASS 0CONT_TEACH_CLASS_INFO_TRACK 0CONT_TEACH_CLASS_MEMBER 0ERROR_CF 0EXAM_ATTENDED 0EXAM_BUYJOIN_BOOK 0EXAM_CERT 0EXAM_CURR_SUBJECT 0EXAM_DUP_QUESTIONS 0EXAM_GROUP_CONF 0EXAM_GROUP_SIGN_COUNT 0EXAM_HN_HGZ_ORGAN 0EXAM_HN_HGZ_TEMP 0EXAM_NODE_STATUS 0EXAM_ORGAN_CONF 0EXAM_PAPER 0EXAM_PAPER_CONF 0EXAM_PAPER_CONF_DETAIL 0EXAM_PAPER_ITEMS 0EXAM_PAPER_VERSION_CONF 0EXAM_QUESTIONS 0EXAM_QUESTION_ITEMS 0EXAM_SUBJECT_COMB 0EXAM_USER 0EXAM_USER_ANSWER 0
数据库大体结构示意
危害等级:高
漏洞Rank:12
确认时间:2016-01-14 09:29
谢谢
暂无