当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0156439

漏洞标题:浙江大学求是物业管理有限公司存在SQL注入

相关厂商:浙江浙大求是物业

漏洞作者: 路人甲

提交时间:2015-11-28 23:30

修复时间:2016-01-16 17:40

公开时间:2016-01-16 17:40

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:7

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-28: 细节已通知厂商并且等待厂商处理中
2015-12-02: 厂商已经确认,细节仅向厂商公开
2015-12-12: 细节向核心白帽子及相关领域专家公开
2015-12-22: 细节向普通白帽子公开
2016-01-01: 细节向实习白帽子公开
2016-01-16: 细节向公众公开

简要描述:

浙江浙大求是物业存在SQL注入

详细说明:

浙江浙大求是物业存在SQL注入
注入点:http://**.**.**.**/news.jsp?id=36
Database: QIUSHI
[575 tables]
+--------------------------------+
| CRM_CONTRACT |
| CRM_CONTRACT_SP |
| CUSTOMER_INFO |
| CUSTOMER_INFO_SERVE |
| EXAMPLE_LEAVE |
| EXAMPLE_LEAVE_SP |
| ILINK_DURSUB |
| ILINK_NPMESSAGES |
| ILINK_PMESSAGES |
| KD_ABROAD_COST |
| KD_ABROAD_DOCUMENT |
| KD_ABROAD_FLOW_ABROAD |
| KD_ABROAD_FLOW_BASIC |
| KD_ABROAD_FLOW_CHECK_WORK |
| KD_ABROAD_FLOW_POLI |
| KD_ABROAD_FLOW_POLI2 |
| KD_ABROAD_FLOW_POLI_CHECK |
| KD_ABROAD_FLOW_POLI_COMMENT |
| KD_ABROAD_FLOW_POLI_RECORD |
| KD_ABROAD_FLOW_TRAVEL |
| KD_ABROAD_FLOW_VISITOR |
| KD_ABROAD_INFOBANK |
| KD_ABROAD_PASSPORT |
| KD_ABROAD_PASSPORT_STATUS |
| KD_ABROAD_POLI_CHECK |
| KD_ABROAD_POLI_CHECK2 |
| KD_ABROAD_POLI_FAMILY |
| KD_ABROAD_SUMMARY |
| KD_ABROAD_SUMMARY_COMMENT |
| KD_ACCOUNTING_INFO |
| KD_ADDRESS_GROUP |
| KD_ANSWER |
| KD_ASSETS_CATEGORY_A |
| KD_ASSETS_CATEGORY_B |
| KD_ASSETS_CONSUMING |
| KD_ASSETS_CONSUMING_DETAIL |
| KD_ASSETS_CONSUMING_RETURN |
| KD_ASSETS_ENTER |
| KD_ASSETS_ENTER_DETAIL |
| KD_ASSETS_GOODS |
| KD_ASSETS_PURCHASE |
| KD_ASSETS_PURCHASE_DETAIL |
| KD_ASSET_GOODS_INFO |
| KD_ASSET_GOODS_INFO_ADD |
| KD_ASSET_TYPE |
| KD_ATTACHFILE |
| KD_BBS_FORUMS |
| KD_BBS_GROUPS |
| KD_BBS_POSTS |
| KD_BBS_STATISTICS |
| KD_BBS_THREADS |
| KD_BILLING_INFO |
| KD_BUDGET_ADJUST_DETAIL |
| KD_BUDGET_ADJUST_FLOW |
| KD_BUDGET_DEDUCT_DETAIL |
| KD_BUDGET_DETAIL |
| KD_BUDGET_MAKE_FLOW |
| KD_BUDGET_SCHEDULE |
| KD_BUILDING_FUNCTIONAL_AREA |
| KD_BUILDING_MANAGEMENT |
| KD_CARMANAGE |
| KD_CHECK_MONITOR |
| KD_CLEAN_CHECK |
| KD_CLEAN_PLAN |
| KD_CLIENT_BASIC |
| KD_CLIENT_DETAIL_CORP |
| KD_CLIENT_DETAIL_OTHER |
| KD_CLIENT_DETAIL_PER |
| KD_CLIENT_MEMBER |
| KD_COMPLAIN_MANAGE_DEPT |
| KD_COMPLAIN_MANAGE_FLOW |
| KD_COMPLAIN_MANAGE_FOLLOW |
| KD_COMPLAIN_REPORT_DEPT |
| KD_COMPLAIN_REPORT_FLOW |
| KD_COMPLAIN_REPORT_FOLLOW |
| KD_CONTRACT_BASIC |
| KD_CONTRACT_FLOW_BASIC |
| KD_CONTRACT_FLOW_PAY |
| KD_CONTRACT_FLOW_PRODUCT |
| KD_CONTRACT_PAY |
| KD_CONTRACT_PRODUCT |
| KD_CONTRACT_SERVE_BASIC |
| KD_CONTRACT_SERVE_PAY |
| KD_CONTRACT_SERVE_PRODUCT |
| KD_COSTTYPE_MODULE_MAP |
| KD_COST_TYPE |
| KD_CUSTOMER_INFO |
| KD_CUSTOMER_INFO_NUM |
| KD_CUSTOMER_MATERIAL |
| KD_CUS_APPLY_INFO |
| KD_CUS_REGIST_INFO |
| KD_DAYTODAY_BASIC |
| KD_DAYTODAY_MONEY |
| KD_DEPLOY_RECORD |
| KD_DEVICE_REPAIR |
| KD_DICTIONARY |
| KD_DINNER_ITEMS |
| KD_DINNER_ITEM_BRAND |
| KD_DINNER_ITEM_DETAIL |
| KD_DINNER_MEAL_FEE_FLOW |
| KD_DINNER_PRESENT_DETAIL |
| KD_DINNER_PRESENT_FLOW |
| KD_DINNER_TRANSFER_FLOW |
| KD_DINNER_WAITOR |
| KD_DOCUMENT_BOOK |
| KD_DOCUMENT_CATALOG |
| KD_DOCUMENT_INFO |
| KD_DOCUMENT_PARAMETER |
| KD_DOCUMENT_PARAMETER_DETAIL |
| KD_DOCUMENT_READ |
| KD_DOCUMENT_SHARE |
| KD_DOC_DOCUMENT |
| KD_EMPLOYEE_INFO |
| KD_EMPLOYEE_ORG |
| KD_EMPLOYEE_RENEWAL |
| KD_EMPLOYEE_USER |
| KD_ENGINEER_ACTIVITYFIRE_APPLY |
| KD_ENGINEER_DEVICE_CARD |
| KD_ENGINEER_DEVICE_INFO |
| KD_ENGINEER_DEVICE_ROOM |
| KD_ENGINEER_DEVICE_SERVICE |
| KD_ENGINEER_SERVICE_DEVICEINFO |
| KD_EVECTION_ALLOWANCE |
| KD_EVECTION_APPLY_FLOW |
| KD_EVECTION_CHARGE |
| KD_EVECTION_CITY_CLASS |
| KD_EVECTION_CLOSE_ENTRIES |
| KD_EVECTION_CUSTOMER |
| KD_EVECTION_DISPATCHING |
| KD_EVECTION_FEE_ASSUME |
| KD_EVECTION_ON_BUSINESS |
| KD_EVECTION_OTHER_EXPENSES |
| KD_EVECTION_OTHER_INFO |
| KD_EVECTION_TRAVALMESSAGE |
| KD_EVECTION_TRAVELEXPENSE |
| KD_EVENT_REGISTER |
| KD_EXHIBITION_DATA |
| KD_EXHIBITION_FEEDBACK |
| KD_EXPECTED_FLIGHT_INFO |
| KD_FINANCE_CARDNUM |
| KD_FINANCE_CHARGES_RECORD |
| KD_FINANCE_COST_ITEM |
| KD_FINANCE_COST_ITEM_SET |
| KD_FINANCE_COST_ITEM_TYPE |
| KD_FINANCE_DEPOSIT |
| KD_FINANCE_DEPOSIT_DEDUCTION |
| KD_FINANCE_HAVE_CHARGES |
| KD_FINANCE_WILL_CHARGES |
| KD_FIRE_SAFETY_MANAGE_DEPLOY |
| KD_FLOW_EVECTION |
| KD_FLOW_LEAVE |
| KD_FLOW_PLAN_MAIN |
| KD_FLOW_PLAN_SUB |
| KD_FLOW_PRINT_STAMP |
| KD_FLOW_REPORT_MAIN |
| KD_FLOW_REPORT_PERSON |
| KD_FREE_PROCESS_APPROVER |
| KD_FUEL_BUDGET |
| KD_GRASP_DOC_FLOW |
| KD_HIDDEN_DANGER |
| KD_HIRING_BASIC |
| KD_HOSPITALITY_APPLY |
| KD_HOSPITALITY_APPLY_DETAIL |
| KD_HOSPITALITY_RS |
| KD_HOSPITALITY_RS_DETAIL |
| KD_HOUSE_CHECK_IN |
| KD_HOUSE_MANAGE |
| KD_INCOMING_MESSAGE |
| KD_INFORELEASE_FLOW |
| KD_INFO_TYPE |
| KD_INTERDIC |
| KD_INTERNAL_CHECK |
| KD_JDUGE |
| KD_JDUGED_MEN |
| KD_LESSEE_INFO |
| KD_LESSEE_LINKMAN_INFO |
| KD_LEVEL |
| KD_MANAGEMENT_DISTRICT_INFO |
| KD_MEETINGROOM_BOOK_EQU |
| KD_MEETINGROOM_BOOK_FLOW |
| KD_MEETINGROOM_BOOK_GOODS |
| KD_MEETINGROOM_EQU |
| KD_MEETINGROOM_GOODS |
| KD_MEETINGROOM_SET |
| KD_MEETING_ARRANGE |
| KD_MENU |
| KD_MENU_DEFAULT |
| KD_MENU_FAVORITE |
| KD_MENU_LOG |
| KD_MENU_PURVIEW |
| KD_MENU_USER |
| KD_MODULE |
| KD_NEW_WORK_ITEMS |
| KD_OPERATION_FLOW_SET |
| KD_OPERATION_SET |
| KD_OPINIONINFO |
| KD_ORGANIZATION |
| KD_ORG_ORG |
| KD_ORG_ROLE |
| KD_ORG_USER |
| KD_OUTUNIT_PAY_FLOW |
| KD_OUTUNIT_PAY_FLOW_CONTRACT |
| KD_OUTUNIT_PAY_FLOW_RECORD |
| KD_PAGE_SEND_UNITS |
| KD_PARKING_AREA_DATA |
| KD_PARKING_REGION |
| KD_PARKING_RENT_FINANCE |
| KD_PARKING_RENT_MESSAGE |
| KD_PARKING_SPACE_APPLY |
| KD_PARKING_SPACE_DATA |
| KD_PARKING_SPACE_RENT |
| KD_PARTICULAR_MONEY |
| KD_PAYMENT |
| KD_PAYMENT_ASSUME_DETAIL |
| KD_PAYMENT_ASSUME_FLOW |
| KD_PAYMENT_DAILY_ASSUME |
| KD_PAYMENT_DAILY_COST |
| KD_PAYMENT_DAILY_CUSTOMER |
| KD_PAYMENT_DAILY_EXPENSE |
| KD_PAYMENT_DAILY_FLOW |
| KD_PAYMENT_LOAN_FLOW |
| KD_PAYMENT_PROJECT_ASSUME |
| KD_PAYMENT_PROJECT_COST |
| KD_PAYMENT_PROJECT_FLOW |
| KD_PAYMENT_REPAYMENT_FLOW |
| KD_PAY_FLOW |
| KD_PAY_FLOW_CONTRACT |
| KD_PAY_FLOW_RECORD |
| KD_PERSONAL_ADDRESS |
| KD_PLAN_MAIN_ITEM |
| KD_PLAN_MONTH |
| KD_PLAN_MONTH_ITEM |
| KD_PLAN_SUB_ITEM |
| KD_PLAN_WEEK |
| KD_PLAN_WEEK_ITEM |
| KD_POST |
| KD_POST_ADJUST |
| KD_POST_STAFFING |
| KD_PROJECT_BUDGET |
| KD_PROJECT_COST_MAP |
| KD_PROJECT_FLOW |
| KD_PROJECT_FLOW_BUDGET |
| KD_PROJECT_FLOW_USEDBUD |
| KD_PROJECT_PARTICIPANT |
| KD_PROJECT_TYPE |
| KD_PROPAGANDIZE_COST_ITEM |
| KD_PROPAGANDIZE_FLOW_MAIN |
| KD_PS_COMMENT |
| KD_PS_COMMENT_ITEM |
| KD_PURVIEW_DATA_RANGE |
| KD_PURVIEW_NEW |
| KD_PURVIEW_OBJECT |
| KD_QF_COST_TYPE |
| KD_QF_EVECTION_CLOSE_ENTRIES |
| KD_QF_EVECTION_ENTRIES_LOAN |
| KD_QF_EVECTION_FEE_ASSUME |
| KD_QF_EVECTION_OTHER_EXPENSES |
| KD_QF_EVECTION_TRAVALMESSAGE |
| KD_QF_EVECTION_TRAVELEXPENSE |
| KD_QF_PAYMENT_DAILY_ASSUME |
| KD_QF_PAYMENT_DAILY_COST |
| KD_QF_PAYMENT_DAILY_CUSTOMER |
| KD_QF_PAYMENT_DAILY_FLOW |
| KD_QF_PAYMENT_LOAN_FLOW |
| KD_QF_PAYMENT_REPAYMENT_FLOW |
| KD_QUALITY_MEDIA |
| KD_QUALITY_TRAIN_PLAN |
| KD_QUALITY_TRAIN_PLAN_DETAIL |
| KD_QUALITY_TRAIN_RECORD |
| KD_QUALITY_TRAIN_RECORD_DETAIL |
| KD_QUESTION |
| KD_QUESTION_LEVEL |
| KD_RECRUIT_FLOW |
| KD_REIMBURSEMENT_BASIC |
| KD_REIMBURSEMENT_MONEY |
| KD_REIMBURSEMENT_VISITOR |
| KD_REMIND |
| KD_REMIND_TIME |
| KD_REMIND_USER |
| KD_RENT_CONTRACT_DISCOUNT |
| KD_RENT_CONTRACT_FLOW |
| KD_RENT_CONTRACT_FREE |
| KD_RENT_CONTRACT_PAYMENT |
| KD_RENT_CONTRACT_ROOM |
| KD_RENT_CONTRACT_TERM |
| KD_RENT_CONTRACT_TZ |
| KD_RENT_CONTRACT_TZ_FILEUPDATE |
| KD_REPORTINFO |
| KD_REPORTINVOICE |
| KD_REPORT_ACCOMMODATION_ITEM |
| KD_REPORT_BUDGET_ITEM |
| KD_REPORT_FEE_ASSUME |
| KD_REPORT_FLIGHT_ITEM |
| KD_REPORT_PERSON_ITEM |
| KD_REPORT_SHARE_BASIC |
| KD_REPORT_SHARE_MESSAGE |
| KD_REPORT_STAND_ITEM |
| KD_REWARD |
| KD_REWARD_PUNISH |
| KD_ROLE |
| KD_ROLE_ROLE |
| KD_ROLE_USER |
| KD_RZSYS |
| KD_SALARY_ADJUST |
| KD_SALARY_ADJUST_DETAIL |
| KD_SALARY_APPROVE |
| KD_SALARY_APPROVE_DETAIL |
| KD_SALARY_INFO |
| KD_SALARY_MAKE |
| KD_SALARY_UPDATE_RECORD |
| KD_SEQENCE_ID |
| KD_SERVE_PAY_FLOW |
| KD_SERVE_PAY_FLOW_CONTRACT |
| KD_SERVE_PAY_FLOW_RECORD |
| KD_SUBSIDY_MONEY |
| KD_SUMMARY_MONTH |
| KD_SUMMARY_MONTH_ITEM |
| KD_SUMMARY_WEEK |
| KD_SUMMARY_WEEK_ITEM |
| KD_SUPPLIES_CONSUMING_DETAIL |
| KD_SUPPLIES_CONSUMING_FLOW |
| KD_SUPPLIES_CONSUMING_TOTAL |
| KD_SUPPLIES_INVENTORY |
| KD_SUPPLIES_INVENTORY_RECORD |
| KD_SUPPLIES_PAY_DETAIL |
| KD_SUPPLIES_PAY_FLOW |
| KD_SUPPLIES_STOCK_DETAIL |
| KD_SUPPLIES_STOCK_FLOW |
| KD_SUPPLIES_STORAGE |
| KD_SUPPLIES_STORAGE_DETAIL |
| KD_SUPPLIES_STYLE_BIG |
| KD_SUPPLIES_STYLE_GOODS |
| KD_SUPPLIES_STYLE_SMALL |
| KD_SYNCHROFLOW_COMMENTS |
| KD_SYNCHROFLOW_ENTRUST |
| KD_SYNCHROFLOW_ENTRUST_WORK |
| KD_SYNCHROFLOW_LOG |
| KD_SYNCHROFLOW_PROCESS |
| KD_SYNCHROFLOW_SET |
| KD_SYSTEM_CODE |
| KD_SYSTEM_LOGIN |
| KD_SYSTEM_PARAMETER |
| KD_TICKETMANAGE |
| KD_TRAFFIC_ARRANGEMENT |
| KD_TRAINING_DEFINE |
| KD_TRAINING_DEFINE_ITEM |
| KD_TRAINING_FEEDBACK |
| KD_TRAINING_FLOW |
| KD_TRAINING_RESULT |
| KD_TRAINING_RESULT_ITEM |
| KD_TRAINING_SIGN |
| KD_TRAINING_SIGNUP |
| KD_UPDATE_BANK_CARD_LOGS |
| KD_USER |
| KD_USER_ONLINE |
| KD_VEHICLE_CARD_DATA |
| KD_VEHICLE_CARD_HIS |
| KD_VEHICLE_DATA |
| KD_WAREHOUSE_BASE |
| KD_WAREHOUSE_CATEGORY |
| KD_WAREHOUSE_CATEGORY_A |
| KD_WAREHOUSE_CATEGORY_B |
| KD_WAREHOUSE_CONSUMING |
| KD_WAREHOUSE_CONSUMING_DETAIL |
| KD_WAREHOUSE_CONSUMING_RETURN |
| KD_WAREHOUSE_ENTER |
| KD_WAREHOUSE_ENTER_DETAIL |
| KD_WAREHOUSE_GOODS |
| KD_WAREHOUSE_ORG |
| KD_WAREHOUSE_PURCHASE |
| KD_WAREHOUSE_PURCHASE_DETAIL |
| KD_WAREHOUSE_STORAGE |
| KD_WAREHOUSE_USER |
| KD_WEEK_WORK |
| KD_WEEK_WORK_DETAIL |
| KD_WJ_ALDI |
| KD_WJ_CHECKINMONEY |
| KD_WJ_CHECKINMONEY_INFO |
| KD_WJ_CUSTOMERMANAGE |
| KD_WJ_CUSTOME_DETAIL |
| KD_WJ_CUSTOME_SUB |
| KD_WJ_DESTINATION |
| KD_WJ_EXPCORP |
| KD_WJ_FHAPPLY |
| KD_WJ_FHOUTSTORY |
| KD_WJ_FHOUTSTORY_GOODS |
| KD_WJ_FHPRODUCTION |
| KD_WJ_FINANCE_REMIT |
| KD_WJ_HOFER |
| KD_WJ_INSTORAGE |
| KD_WJ_INSTORAGEMANAGE |
| KD_WJ_INSTORAGE_GOODS |
| KD_WJ_INVOICE |
| KD_WJ_INVOICE_DETAIL |
| KD_WJ_ITEMALDI |
| KD_WJ_ONTHEWAYMANAGE |
| KD_WJ_ORDERINFO |
| KD_WJ_ORDERMANAGE |
| KD_WJ_ORDERPAY |
| KD_WJ_OTHERGOODS |
| KD_WJ_OTHERMAIL |
| KD_WJ_OTHERSTORAGE |
| KD_WJ_OUTINFO |
| KD_WJ_OUTSTORAGEGH |
| KD_WJ_OUTSTORAGEMANAGE |
| KD_WJ_OUTSTORY |
| KD_WJ_OUTSTORY_GOODS |
| KD_WJ_OVERDUE |
| KD_WJ_RETURNSTORAGE |
| KD_WJ_RETURNSTORAGE_GOODS |
| KD_WJ_RETURN_OUTSTORAGE |
| KD_WJ_SHADDRESS |
| KD_WJ_STORYMANAGE |
| KD_WJ_TEMPPRODUCTION |
| KD_WJ_WAYMANAGEGOODS |
| KD_WORKLOG |
| KD_WORKSHEET_MANAGE |
| KD_WORKSHEET_PARTICIPANT |
| KD_WORK_ACHIEVE_PERSON |
| KD_WORK_COMMENT |
| KD_WORK_PLAN_QS |
| KD_WORK_SUMMARY_QS |
| PBCATCOL |
| PBCATEDT |
| PBCATFMT |
| PBCATTBL |
| PBCATVLD |
| PERSONNEL_BASEINFO |
| PERSONNEL_FAMILY |
| PERSONNEL_WORKBEFORE |
| T_ACTION_DEF |
| T_ACTIVITY_DEF |
| T_ACTIVITY_DEF_HIS |
| T_ACTIVITY_EXTPARTICIPANT |
| T_ACTIVITY_INS |
| T_ACTIVITY_INS_HIS |
| T_ACTIVITY_RELEVANT |
| T_APPLICATION |
| T_APPLICATIONVARIABLE |
| T_APPLICATION_INS |
| T_APP_FORMAL_ARGS |
| T_ARCHIVEACTIVITYSINS |
| T_ARCHIVEDMESSAGE |
| T_ARCHIVEPROCESSINS |
| T_ARCHIVEWORKITEM |
| T_ATTACHMENT |
| T_ATTACHMENT_INS |
| T_BUFFERMESSAGE |
| T_CHACTIVITYINSPROP |
| T_CHACTIVITYINSSTATE |
| T_CHPROCESSINSPROP |
| T_CHPROCESSINSSTATE |
| T_CHWORKITEMATT |
| T_CHWORKITEMSTATE |
| T_COMMISIONRULES |
| T_COMPLEX_DATA_ID |
| T_COMPLEX_DATA_ID_HIS |
| T_COMPUTSER |
| T_CONTAINERRUNSTATUS |
| T_CREATEPROCESSINS |
| T_CURRENT_ID |
| T_CURRENT_ID_HIS |
| T_DEF_LOG |
| T_DISTRIBUTEMESSAGE |
| T_DISTRIBUTE_HOST |
| T_DISTRIBUTE_ID |
| T_DYNVIRTUALGROUP_DEF |
| T_DYNVIRTUALGROUP_INS |
| T_DYNVIRTUALGROUP_PRE_DEF |
| T_ENGINE |
| T_ENGINELOG |
| T_EVENT_DEF |
| T_EXCEPTION_DATA |
| T_FORM |
| T_FORMALPARAMETER |
| T_FORM_APP_ARGS |
| T_FORM_INS |
| T_FUNCTION |
| T_GROUP |
| T_LMAP |
| T_LOGIN_OUT |
| T_LOGTYPE |
| T_LOG_OPT |
| T_MAILSENDWORKITEM |
| T_MAILSERVICE |
| T_MAINSIDEINTEROPERATION |
| T_MAIN_SUB |
| T_MANAGER |
| T_MANAGER_ORG |
| T_MEMBER |
| T_MESSAGE |
| T_MODEL |
| T_MODEL_GLOBAL_DATA |
| T_MODEL_GLOBAL_DATA_HIS |
| T_MODEL_GLOBAL_DATA_TYPE |
| T_MODEL_GLOBAL_DATA_TYPE_HIS |
| T_MODEL_HIS |
| T_MODUL |
| T_MOD_FUN |
| T_MOD_MOD |
| T_MONITORTEMPLATE |
| T_MSRECEVIEDMSG |
| T_MSSENDINGMSG |
| T_NEXT_ACTIVITY |
| T_NEXT_ACTIVITY_HIS |
| T_NOTE_ACTIVITY |
| T_NOTE_ACTIVITY_HIS |
| T_OBJECT |
| T_OMAP |
| T_ONLINE |
| T_OPERATETYPE |
| T_OPERATIONCLASS |
| T_ORGANIZATION2 |
| T_ORG_INFO_HIS |
| T_ORG_ORG |
| T_ORG_USER |
| T_PARTICIPANT |
| T_PROCESSDEFREP |
| T_PROCESSOPERTYPE |
| T_PROCESS_AUTOSTART_ARGS |
| T_PROCESS_DEF |
| T_PROCESS_DEF_HIS |
| T_PROCESS_DEF_INFO |
| T_PROCESS_DEF_MANAGE |
| T_PROCESS_FILE_LOG |
| T_PROCESS_FORMAL_PARAM |
| T_PROCESS_FORMAL_PARAM_HIS |
| T_PROCESS_INS |
| T_PROCESS_INS_HIS |
| T_PROC_APP |
| T_PROC_ATT |
| T_PROC_FORM |
| T_RECEIVED_MESSAGE |
| T_RELEVANT_DATA |
| T_RELEVANT_DATA_HIS |
| T_REPORT |
| T_RMAP |
| T_ROLE |
| T_ROLE_ROLE |
| T_ROLE_USER |
| T_SERVERPERMISSION |
| T_SHORTMESSAGSERVICE |
| T_SHOWPARTICIPANT |
| T_SP |
| T_SSRECEIVEDMSG |
| T_SSSENDINGMSG |
| T_SUBSIDEINPEROPERATION |
| T_TOKEN |
| T_TOKENBOX_INS |
| T_TOKENBOX_INS_HIS |
| T_TOKEN_HIS |
| T_TRANSITION_DEF |
| T_TRANSITION_DEF_HIS |
| T_TRANSITION_INS |
| T_TRANSITION_INS_HIS |
| T_TRUESTEDSERVER |
| T_UMAP |
| T_USERCLASS |
| T_USERTABLE2 |
| T_USER_FUN |
| T_USER_FUN_OBJECT |
| T_USER_HIS |
| T_USER_LASTSELECTPS |
| T_USER_LEVEL |
| T_USER_PURVIEW |
| T_USER_TRUST |
| T_VIRTUALGROUP |
| T_VIRTUALGROUP_INS |
| T_WORKFLOW_FILE |
| T_WORKITEM |
| T_WORKITEMNOTIF |
| T_WORKITEM_HIS |
| T_WORKITEM_NEW |
| T_WORKITEM_TABLE_NAME |
| T_WORKITEM_TEMPORARY |
+--------------------------------+
表太多,随便看了几个

1.jpg

2.jpg

3.jpg

4.jpg

5.jpg

6.jpg

7.jpg

8.jpg

漏洞证明:

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-12-02 17:38

厂商回复:

CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给浙江分中心,由浙江分中心后续协调网站管理单位处置。

最新状态:

暂无