乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-01-22： 细节已通知厂商并且等待厂商处理中 2016-01-26： 厂商已经确认，细节仅向厂商公开 2016-02-05： 细节向核心白帽子及相关领域专家公开 2016-02-15： 细节向普通白帽子公开 2016-02-25： 细节向实习白帽子公开 2016-03-08： 细节向公众公开
**.**.**.**:9080/DMSFrameworkWeb/ 首先发现这样一个站点，判断不出，经过转发进入内网。找到目录，写了shell，期间ipconfig了下，发现dns是 **.**.**.**，访问了下主域名发现是上汽通用主站，配置了数据库，发现也是车辆以及车辆维修更换信息，经判断应该是上汽某工作站，域也有好几个。泄露了大量工单信息以及员工内部工作信息，数据过大，截取部分。不知道上汽通用和上汽大众是不是属于一个厂商，如果是请审核调整下，
<name>jdbc/dsASMSSDE</name> <jdbc-driver-params> <url>jdbc:oracle:thin:@localhost:1521:dmsasc</url> <driver-name>oracle.jdbc.xa.client.OracleXADataSource</driver-name> <properties> <property> <name>user</name> <value>owdmsasc</value> </property> </properties> <password-encrypted>{AES}BPAYZgiSrVAc9IUov2OQQ+f3OHQH8s5F7jF+KSHyxbU=</password-encrypted> sgm_ap0m58_user <name>jdbc/dsEWS</name> <jdbc-driver-params> <url>jdbc:oracle:thin:@localhost:1521:dmsasc</url> <driver-name>oracle.jdbc.xa.client.OracleXADataSource</driver-name> <properties> <property> <name>user</name> <value>eservice</value> </property> </properties> <password-encrypted>{AES}+6rCjolg3gQOg3Ov4v550de9pgaxHhGL8yAFGJpVu48=</password-encrypted> sgm_ap0m58_user
数据库配置
Query#0 : select t.TABLE_NAME,t.NUM_ROWS from user_tables t order by NUM_ROWS descTABLE_NAMEVARCHAR2 NUM_ROWSNUMBERTT_DELETE_LOG_HISTORY 20076255TM_WR_CAMPAIGN_VINLIST 17978639TT_CAMPAIGN_VEHICLE 6234208WORKITEMHISTORY 5009645TT_PART_MONTH_REPORT 2061597TT_PART_PERIOD_REPORT 2061597TT_PART_FLOW 1854111TT_BALANCE_REPAIR_PARTS 1753173TT_BALANCE_UNION_PARTS 1481317TT_OPERATE_LOG 1373097TT_REPAIR_ORDER_LINK 1243373TT_BALANCE_LABOUR 1168300TA_SMAP_CUST_CLASS_STAT 1079657TT_CAMPAIGN_COMPLETEVEHICLE 1007851TT_RO_ASSIGN 887731TT_ESTIMATE_REPAIR_PARTS 530731DE_DEMESSAGEIDMAP 485852TT_PRODUCTIVE_VALUE 438404TT_RO_BALANCED 375679TT_BALANCE_ACCOUNTS 375679TT_RO_CLAIM_MAPPING 375338TA_SMAP_VEHICLE_BALANCE_DAILY 352946TA_SMAP_VEHICLE_REPAIR_MONTH 335454TT_DELETE_LOG 305575TT_RECEIVE_MONEY 292362TA_SMAP_VEHICLE_INFO 276797TM_SGM_UPCFNA_PARTCODE 269298TT_TRACING_TASK 254044TT_ESTIMATE_LABOUR 245759TT_PART_WAITORDER_LIST_DETAIL 225230TT_DO_RECEIVE_ITEM 205947TT_PART_SPQ_SHOW_DETAIL 204888TT_PART_BUY_ITEM 199611TT_TOOL_FLOW 196431TT_ORDER_ITEM_RESULT 186091TT_PART_ORDER_ITEM 184127TT_BILLING_ITEM 177892TT_NO_REPORT_ORDER_ITEM 177517TT_GWM_STATUS 174275TM_GWM_PRE_WRT_VINLIST 171151TM_MAIN_PART 160668DE_ASCRECEIVELOG 158116TM_CLAIM_LABOUR_HOUR_DATA 132465DE_ASCSENDSUBLOG 111241DE_ASCSENDLOG 108752TT_TOOL_RETURN_ITEM 97614TT_TOOL_BORROW_ITEM 97599TT_CLAIM_ORDER 91573TT_TOOL_BORROW 81741TT_TOOL_RETURN 80482TT_CLAIM_PART 73659TT_CHARGE_DERATE 70075TM_SPECIAL_SP_LOG 68695TT_SGM_WR_APPPAYMENT 55735TA_SMAP_SERVICE_ANALYSIS 54720TT_ESTIMATE_ORDER 52866TT_CLAIM_RO_ITEM_MAPPING 51179TM_OWNER 50247TM_VEHICLE 46683TM_PLANT_VEHICLE 45485TM_REPAIR_ITEM 41082TT_GWM_RESULT 39529TM_SGM_UPCFNA_LABOR 39277TT_SGM_RETURN 35667TM_SGM_UPCFNA_INFO 35377TT_PART_PERIOD_REPORT_TMP 35012TM_VEHICLE_SGM 32444TM_GWM_WARRANTYCLASS_BY_LABOR 31959TT_PART_INNER_ITEM 30424TT_BOOKING_ORDER_ITEM 28250TM_PART_STOCK 27143TT_ALLOCATE_OUT_ITEM 26468TT_BALANCE_REPAIR_PARTS_3R 24598TT_INSURANCE_FLOW 22974TT_TERMLY_MAINTAIN 22641TT_PART_FLOW_3R 22640TT_NEW_IN_CAR 22572TT_PART_BUY 22131TT_CLAIM_MONTH_REPORT 21453TT_BALANCE_UNION_PARTS_3R 21254TM_CLAIM_LABOUR 20722TT_SPQ_EXCEPTION_MESSAGE 20695TT_BALANCE_LABOUR_3R 19075TT_GWM_STATUS_3R 18772TT_INVOICE 18269TT_PART_PERIOD_REPORT_BAK 17495TT_CLAIM_OTHER_CHARGE 17471TT_PRE_RECEIVE_MONEY 17222TT_CLAIM_PART_PRINT 15753TT_GWM_RESULT_DSP_REASON 15261TM_CLAIM_ADD_LABOUR_HOUR 15136TA_SMAP_BUICK_CUST_STAT 13680TA_SMAP_LOST_CUST_ANALYSIS 13680TT_RO_ASSIGN_3R 13598TT_BALANCE_ADD_ITEM 13438TA_SMAP_BUICK_CUST_STATOEM 13260TT_SHORT_PART 12970TT_PART_INNER 12945TT_TRACING_TASK_QUESTION 11648TT_CLAIM_PART_RTN_ITEM 11503TT_BOOKING_ORDER 10741TT_PRODUCTIVE_VALUE_3R 10498TT_RESERVED_CHANGE 10414TT_BILLING 9563TT_DO_RECEIVE 9554TM_ASC_PT_SP_PART_LIST 9369TT_PART_INVENTORY_ITEM 8861TT_INSURANCE_EXPIRE 7816TT_CAMPAIGN_FINISH_VEHICLE 7801TT_BOOKING_PROMPT 7619TT_MONITOR_VEHICLE 7229TT_CLAIM_ORDER_3R 7222TT_PART_ALLOCATE_OUT 6902TT_BOOKING_ORDER_REMIND 6682TT_VEHICLE_BLOCK 6603TL_CLAP_BPOINT_CHANGE_LOG 6459TT_RO_BALANCED_3R 6120TT_BALANCE_ACCOUNTS_3R 6120TT_BALANCE_ACCOUNTS_EXT 6034TA_ASC_MONTHLY_REPORT_MODEL 5554TI_PART_STOCK 5413TT_SGM_WR_LABOROP_MAP_FVS 5130TI_OWNER_VEHICLE 5057TT_PART_ALLOCATE_ITEM 4923TT_ORDER_RESULT 4914TT_CLAIM_PART_3R 4892TT_PART_ORDER 4383TM_REPAIR_ITEM_MAIN 4365TT_ASC_STAGNANT_INVENTORY 4065TT_DS_ASC_SCANNERLOG 4012TT_GWM_RESULT_3R 3981TT_TRACING_DAY 3894TT_USER_FUNCTION 3861TT_NO_REPORT_ORDER 3614TM_WR_CAMPAIGN_VINRULE 3602TT_REMIND_PLAN 3551TT_PART_SUGGEST_PART_DETAIL 3426TM_CLAIM_NO_RETURN 3183TT_SGM_RETURN_3R 3052TA_SMAP_INCOME_ANALYSIS 2950TA_SMAP_MONTH_RPT_SERIES 2904TA_SMAP_CUST_INSTORE_ANALYSIS 2904TM_CLAP_MEMBER_CONTACTOR 2900TA_SMAP_STAT_SERIES 2882TM_CLAP_MEMBER_VEHICLE 2862TM_CLAP_MEMBER_CARD 2855TM_CLAP_VEHICLE_OWNER 2855TM_CLAP_MEMBER 2855DE_MESSAGE_LOG 2753TT_SGM_WR_CLAIMCORRECT 2732TT_PART_ALLOCATE_IN 2606TT_REJECT_HISTORY 2440TT_BILL_NO 2363TT_SGM_WR_WITHOUTREF 2337TT_ESTIMATE_ADD_ITEM 2204TT_PART_AB_TYPE 2010TT_PART_TRACE_FLOW_ITEM 1962TT_SGM_WR_WCCREFRECORD 1951TM_MAIN_PART_INTERFACE 1938TM_OTHER_LABOUR_HOUR 1935TT_PART_PROFIT_ITEM 1843TT_PART_TRACE_FLOW 1831TT_BALANCE_SALE_PART 1752TT_PART_MOVE_ITEM 1639TT_WAITORDER_PART_DRAFT 1549TM_PART_MONITOR 1443TT_BALANCE_ADD_ITEM_3R 1435TT_RO_REPAIR_PARTS 1380TT_SGM_WR_3R_BASE 1271TM_COMMON_DATA 1233TM_GWM_3C_RELATION 1232TM_PART_TIME 1196TT_PART_BILL_NO 1180TT_PART_LOSS_ITEM 1173TM_ORDERDATE_SET 1153TM_TOOL_STOCK 1152TT_REPORT_ORDER_COUNT 1150TT_TOOL_BUY_ITEM 1135TT_CLAIM_PART_RTN_ITEM_3R 1078DE_TASKSCHEDULERULETARGET 1016TT_CLAIM_OTHER_CHARGE_3R 861TT_SGM_WR_UNWARRANTYPART 838TM_PART_PAINT 830TT_PART_ORDER_CONDITION 813TA_SMAP_MONTH_RPT_VHCLAGE 792TT_SGM_WR_CASELABOUR 744DE_ASCSENDLOGCOUNT 723TT_PART_SUGGEST_PART 694TM_SYSTEM_STATUS 677TT_RO_LABOUR 636TT_PO_DELAY_CANCEL_ITEM 622TT_ROLE_FUNCTION_MAPPING 618TT_USER_OPTION_MAPPING 584TT_CHARGE_DERATE_3R 570TT_SGM_WR_REPAIRLOCATION 568TT_TRACING_WEEK 563TT_USER_HISTORY 535TT_PT_BONUS_USED 531TA_SMAP_MONTH_RPT_REPAIR 528TA_SMAP_TASK_HISTORY 512TT_CLAIM_MONTH_REPORT_3R 490TM_ATTACHMENT_PART 459WORKITEM 440TT_DS_ASC_TABLELIST 425TT_PO_DELAY_CANCEL 400TT_ORDINARY_CLAIM_COLLECT 399TT_CAMPAIGN 391TT_PRE_DEDUCT 380TM_SPECIAL_SQL 373TM_SPECIAL_PARTS 367TM_GWM_PRE_WRT_RULE 353TM_WR_CAMPAIGN_PART 349TM_FUNCTION 348TM_WR_CAMPAIGN 339TT_PART_FAST_FLOW 332TL_DA_OPER_LOG 321TM_PAINT_SUPPLIER_MAPPING 312TT_BOOKING_ORDER_PARTS 309TT_RO_PRE_CLAIM 303TM_PACKAGE_PART 300TM_SPECIAL_LABORCODE 300TT_PART_MOVE 290TT_CLAIM_PART_URGENT_RTN 279TT_PART_CLAIM_ITEM 276TT_VEHICLE_ALARM_REMIND 273TT_PART_CLAIM 272TA_SMAP_MONTH_RPT_VHCLTYPE 264TM_CMG_MY_MAPPING 248TT_PART_COST_ADJUST 243TM_EMPLOYEE 234TM_PART_CUSTOMER 233TT_PART_CLAIM_REPARATIONS 228TT_PART_CLAIM_RETURN_ITEM 225TT_PART_RETURN_INFORM 223TT_PRE_CLAIM_ORDER 220TM_SPECIAL_TABLES 217COPY_TM_EMPLOYEE 216TT_PART_CLAIM_BILLING_ITEM 214TT_PART_CLAIM_BILLING 211TM_WR_CAMPAIGN_REPLACE_PART 208TM_ASC_INFO 204TT_CLAIM_ADD_LABOUR 202TT_BILLING_SUB_ITEM 201TT_ESTIMATE_SALE_PARTS 200TA_ASC_MONTHLY_FINANCE 192TT_REPAIR_ORDER 191TT_CAMPAIGN_ITEM 190TT_RO_PRE_CLAIM_STATUS 188TT_ASC_DATASTORE_ERRLOG 176TM_GWM_AD_REASON_CODES 170DE_APPTYPE 168TT_SGM_WR_BACKREFERENCE 150TT_PART_LEND_RETURN_ITEM 137TM_ACCOUNTING_CYCLE 136TT_CAMPAIGN_RECALLCODE 136TT_PART_LEND_ITEM 136TM_MODEL 135TA_SMAP_CUST_INSURANCE_STAT 132TA_SMAP_BUICK_MONTH_RPT_STAT 132TA_SMAP_BOOKING_STAT 132TM_GWM_CAUSE 131TT_MONTH_CYCLE 131TM_GWM_PRE_WRT_VINRULE 126TT_TOOL_BUY 125TT_SO_PROJECT 123TT_GWM_RESULT_ADJ_REASON 121TM_CLAIM_MODEL_SMC 120TT_SO_PRE_CLAIM_NEW 120TM_ASC_MONTHLY_REPORT 112TT_PART_CLAIM_DISCOUNT 112TA_ASC_NEW_MONTHLY_REPORT 110TT_PART_WAITORDER_LIST 106TT_ORDINARY_CLAIM_INVOICE 105
**.**.**.**:9080/DMSFrameworkWeb/jsp/123.jsp carry
危害等级：中
漏洞Rank：8
确认时间：2016-01-26 08:27
维修站管理的服务器漏洞，已通知并制定修复计划
暂无
