乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-03-31: 细节已通知厂商并且等待厂商处理中 2016-04-04: 厂商已经确认,细节仅向厂商公开 2016-04-14: 细节向核心白帽子及相关领域专家公开 2016-04-24: 细节向普通白帽子公开 2016-05-04: 细节向实习白帽子公开 2016-05-19: 细节向公众公开
http://**.**.**.** 存在jboss反序列命令执行,只能用jspx或者写shell 到jmx-console里,策略禁止在default下执行jsp脚本。通过查找配置数据库发现大量数据,近千万的订单详情,以及几百万的个人详细的身份证信息以及收货地址信息,危害极大数据库涉及内网多台主机。截取部分数据已证明危害,
<local-tx-datasource> <jndi-name>TBMPKDataSource</jndi-name> <connection-url>jdbc:sqlserver**.**.**.**:1433;DatabaseName=cop_tbm;SelectMethod=Cursor</connection-url> <driver-class>com.microsoft.sqlserver.jdbc.SQLServerDriver</driver-class> <connection-property name="user">tbmsql</connection-property> <connection-property name="password">tbm123</connection-property> <min-pool-size>1</min-pool-size> <max-pool-size>10</max-pool-size> </local-tx-datasource></datasources> <local-tx-datasource> <jndi-name>TOSADDataSource</jndi-name> <connection-url>jdbc:sqlserver**.**.**.**:1433;DatabaseName=QuanYou-DB;SelectMethod=Cursor</connection-url> <driver-class>com.microsoft.sqlserver.jdbc.SQLServerDriver</driver-class> <connection-property name="user">sa</connection-property> <connection-property name="password">P@ssw0rd!123</connection-property> <min-pool-size>5</min-pool-size> <max-pool-size>100</max-pool-size> </local-tx-datasource>
数据库配置
Query#0 : select rows,OBJECT_NAME(id) as TABLENAME from sysindexes where indid=0rowsint TABLENAMEnvarchar2 sysfiles190 T_TBM_SALE_TASK553033 T_TBM_CHECK_DETAIL_A2015060 F_STOCK_APPLY12 temp_1559465 T_MDM_CHAN_DIS_SERIES_INFO17894 T_TBM_SIGN_IN_A2015060 T_TBM_PRICE_PROGRAM356 T_TBM_STOCK_ADJUST_DETAIL_PRICE_2016012238208 T_TBM_STAFF173 T_TBM_SALE_TASK_DETAIL877126 T_TBM_SIGN_IN_DETAIL_A2015064 CAP_USER_201506115889333 T_TBM_SHOP_PRICE_SAD7592 T_MDM_CHAN_DIS_STORE1504117 T_TBM_STOCK_TERM_STATISTICS_A2015060 T_TBM_PRICE_PROGRAM_DETAIL1 T_TEMP_ACCOUNT_IMP3244130 T_MDM_PRO_REL_PRO_SALE_ORG5530807 T_TBM_MY_PRODUCT_SAD10592442 T_TBM_STOCK_OUTIN_DETAIL29 T_MDM_CHAN_OFFICE_INFO1070627 T_TBM_STOCK_TERM_STATISTICS_A2015050 T_TBM_STOCK_BATCH_A201505418 tmp_dis_info3868975 T_TBM_PURBILL_DETAIL7301 T_TBM_PATCH_PIC_20150808_BAK0 T_MDM_CHAN_SHOP_DECORATION97 tmp_shop_info1891850 T_TBM_STOCK_BATCH_A2015069827 T_TBM_SP_REDACT_20150724_BAK421 T_TBM_STOCK_ADJUST_DETAIL_CAL_IN_201601221327 tmp_store_info825824 T_TBM_STOCK_OUTIN3617 T_MDM_CHAN_SHOP_INFO1509690 T_TBM_STOCK_TERM_STATISTICS_B201506167115 T_TBM_CHECK_DETAIL_PRICE_OUT_2016012266390 T_TBM_SAMPLE_UP_DETAIL102682 T_TBM_PATCH_PLATE_20150807_bak0 FV_INFO_STRUCT919749 T_TBM_STOCK_TERM_STATISTICS_B201505532 T_TBM_CHECK_DETAIL_PRICE_CAL_OUT_201601221160 T_TBM_CHECK_DETAIL_CAL_OUT_20160122356 T_TBM_STOCK_ADJUST_DETAIL_PRICE_CAL_OUT_201601221600497 T_TBM_PICK_DETAIL11279 CAP_USER_20150815_BAK47557 T_MDM_ORG_ADMIN_REGION2127 T_TBM_SIGN_IN_DETAIL_CAL_IN_2016012245438 T_TBM_PATCH_SIGN_DETAIL_20150810_BAK5 T_MDM_ORG_CHANNEL_DISTR1160 TEMP_201637395 cust_bak1160 T_TBM_CHECK_DETAIL_CAL_IN_2016012217 T_MDM_ORG_SALE_DEPT42021 T_TBM_SP_REDACT_CUSTOM0 T_TBM_SALE_BILL_DETAIL_PACK_PRICE_20160122559710 T_TBM_PICK10996018 T_TBM_STOCK_HIS308 T_MDM_ORG_SALE_GROUP131 T_TBM_STOCK_BATCH_TOTAL_FEE_OFFICE_10015831456 T_TBM_STOCK_BATCH_HIS560 T_TBM_SP_REDACT_NUM44046 T_TBM_SALE_BILL_DETAIL_QUANTITY_OUT_2016012396409 T_TBM_STOCK_OUTIN_RECORD_HIS33 T_MDM_ORG_SALE_ORG44046 T_TBM_SALE_BILL_DETAIL_RETURN_2016012345 T_TBM_FEEDBACK557332 T_TBM_STOCK_OUTIN_HIS41289 T_TBM_SP_REDACT_OLD_PRODUCT74 T_TBM_STOCK_ALLOT1648476 T_TBM_STOCK_OUTIN_DETAIL_HIS68410 T_TBM_SIGN_IN_201509041748 T_TBM_STOCK_TERM_STATISTICS_HIS1353 T_TBM_STOCK_ALLOT_DETAIL11284 cap_user_20150811_bak80341 customer_bak_6_19809 T_TBM_OPTION_INFO771735 T_TBM_SALE_BILL_DETAIL_SEND_PACK_2016012318 TMP0053518245 T_TBM_STOCK28531 T_TBM_ECBILL_DETAIL_BAK1 T_ACCOUNT_IMP336 T_TBM_QUESTION_INFO0 T_ACCOUNT_IMP_BAK4780 T_TBM_SALE_BILL_DETAIL_SEND_2016012311 T_TBM_QUESTION_BANK291288 T_TBM_STOCK_ADJUST_DETAIL81 T_MDM_PRO_CATEGORY27317 T_TBM_SALE_BILL_DETAIL_ERROR_PACK_20160123219590 T_TBM_SIGN_IN 20W+车辆信息10816 CAP_USER_20150714_BAK34360 T_TBM_SALE_BILL_M1_201601231 ANHUIBAN734 T_MDM_PRO_COLOR_NUM34360 T_TBM_SALE_BILL_OUT_M1_201601230 F_HANDSET_GET_PACK86559 customer_bak_6_2262097 T_MDM_PRO_PRODUCT_MODEL0 T_TBM_HANDLE_LOG464 tmp31698 T_MDM_PRO_REL_MATERIAL_MATCH197513 T_TBM_STOCK_OCCUPY208 T_MDM_PRO_PRODUCT_SERIES247 tmp310 T_TBM_SYS_LOGIN_LOG18 tmp32157274 T_TBM_SALE_BILL_BAK_2015072711752326 T_TBM_SIGN_IN_DETAIL95 T_TBM_SALE_BILL_DETAIL_20160104357666 T_MDM_PRO_PRODUCT_INFO_20150814_BAK9 T_MDM_PRO_PRODUCT_STYLE4 T_TBM_EC_LOGISTIC201601060 T_MDM_PRI_NO_SALES_PRICE_TOTAL_BAK295 T_TBM_PURBILL_1000695853527 T_TBM_POLICY_PUR2206 T_MDM_PRI_SALES_PRICE_TOTAL_BAK13082943 T_TBM_STOCK_OUTIN_RECORD9547 T_TBM_SAMPLE_DOWN0 T_MDM_PRO_REL_PRO_GROUP_SALE_ORG4534 T_TBM_PURBILL_DETAIL_1000695446 T_TBM_SIGN_IN_20150707441429 T_TBM_SYNC_NO_SALES_PRICE_TOTAL23 T_TBM_SP_REDACT_10006950 T_TBM_SURVEY7123 T_TBM_PATCH_PIC_20150814_BAK102 T_MDM_PRO_SALE_SERIES2457 T_TBM_STOCK_1000695775 T_TBM_STOCK_OUTIN_100069546651 tmp220 T_MDM_ZONE_SALE_COMM8378 T_TBM_STOCK_OUTIN_DETAIL_10006951508071 T_MDM_PRI_NO_SALES_PRICE_TOTAL_15101263 T_TBM_SIGN_IN_20150613174 T_TBM_PATCH_RESTRICT_BAK731 T_TBM_DELIVERY_1000695487 T_TBM_STORE_PACKAGE36 T_MDM_ZONE_SALE_AREA19729 T_TBM_SEQUENCE_bak2015072815182 T_TBM_SIGN_IN_20150613_ALL695 T_TBM_PICK_10006951 T_TBM_PURBILL20160112710 T_TBM_PICK_DETAIL_1000695149 TMP_SIGN38399 T_TBM_IMP_EXCEL1652537 tmp1 160W+ 家私订单1329 T_TBM_STORE_PACKAGE_DETAIL1055 T_TBM_STOCK_WARN36 T_MDM_ZONE_SALE_MARKET41224 T_TBM_SP_REDACT2 T_TBM_CHECK_100069540269 T_TBM_STOCK_ADJUST4313 T_TBM_PATCH_BILL_20150729_BAK106 T_MDM_PRO_FACTORY_INFO2 T_MDM_ZONE_SALE_RANGE0 T_TBM_IMP_RESULT0 T_TBM_ECBILL201601135 T_MDM_ZONE_SALE_REGION11 T_TBM_SIGN_IN_TMP0 T_TBM_SIGN_IN_DETAIL_201507070 T_TBM_ECBILL_DETAIL201601132063 ypr_test_010 T_TBM_CHECK_DETAIL_TEMP20 T_MDM_ZONE_SALE_ZONE260310 T_TBM_PATCH_PLATE_STRUCT_20150816_BAK2748363 tmp_sale_price2950 T_TBM_PATCH_BILL_20160114_BAK2569187 tmp_sale_price_bak277327 T_TBM_PATCH_PLATE_STRUCT_20160115_BAK36 T_SAP_OFFICE_TO_CUSCODE260 T_TBM_CARPOOL150 T_TBM_SIGN_IN_201510147607 T_TBM_PATCH_PIC_20160115_BAK53638 tmp_sale_price_no108006 T_TBM_PATCH_PLATE_20160115_BAK530 T_TBM_CARPOOL_DETAIL5889333 T_TBM_SHOP_PRICE_SAD_BAK10742 CAP_USER_201507070 T_IMP_PLATE10832 cap_user_bak_201507172633 T_IMP_PLATE_STR2 t_notice0 T_IMP_PIC21122 T_TBM_PATCH_BILL_20150819_BAK2896752 T_TBM_CHECK_DETAIL28 CAP_ROLE_20150707_BAK0 F_STOCK_SALE_HEAD7123732 T_MDM_PRI_NO_SALES_PRICE_TOTAL_tmp49 T_TBM_COMPLAINT294335 tmp_zlfl7659508 T_MDM_PRI_SALES_PRICE_TOTAL_tmp 700W家私订单0 T_TBM_STOCK_OUTIN_RECORD_20150547 T_TBM_CUSCHEST_DEMAND_BAK967366 T_TBM_STOCK_OUTIN_RECORD_B2015056856 T_MDM_PRI_SALES_PRICE_TOTAL_tmp011005 T_TBM_CUSCHEST_DEMAND0 F_STOCK_INSEND24742 T_TBM_STOCK_OUTIN_B2015050 T_TBM_PUR_CHECK910619 T_TBM_STOCK_OUTIN_DETAIL_B2015050 T_TBM_CHECK_PACK_DETAIL_REPEAT0 F_STOCK_INWAY12150 T_TBM_PICK_B2015050 T_TBM_CHECK_PACK_DETAIL1241310 tmp_STOCK_BATCH33709 T_TBM_PICK_DETAIL_B2015057 T_TBM_PURBILL_201509086859 T_MDM_PRI_SALES_PRICE_TOTAL_tmp02853790 T_TBM_DELIVERY311 T_TBM_SAMPLE_UP_B2015057 T_TBM_PURBILL_DETAIL_201509081267 T_TBM_SAMPLE_UP_DETAIL_B201505120 app_menu201601170 T_TBM_DISTRIBUTOR_ACCOUNT259 T_TBM_SAMPLE_DOWN_B201505622 CAP_RESAUTH_20160117_BAK1939 T_TBM_SAMPLE_DOWN_DETAIL_B2015053 T_TBM_STOCK_ALLOT_B2015051228 CAP_USER2016022333 T_TBM_INFO19912 T_TBM_STAFF_BAK2187 T_TBM_CUSCHEST_DEMAND_DETAIL45570 T_TEMP_DIS_SERIES_IMP6724 T_MDM_CHAN_DIS_STORE_151126591 tmp00111 T_TBM_STOCK_ALLOT_DETAIL_B2015052 app_menu_bak167 tmp_mgr_error9965 T_TBM_CHECK_B20150539262 T_TBM_PUR_DRAFT_TMP770777 T_TBM_CUSTOMER937780 T_TBM_CHECK_DETAIL_B201505150 tmp_mgr_error_239262 T_TBM_PUR_DRAFT_TMP2704 T_TBM_SIGN_IN_B201505150 tmp_mgr_error_339262 T_TBM_PUR_DRAFT_TMP357268 T_TBM_SIGN_IN_DETAIL_B20150510577 CAP_USER_BAK_20150601243 TEMP1967366 T_TBM_STOCK_OUTIN_RECORD_A201505586034 T_TBM_REFUND1574982 tmp_STOCK_BATCH_TYPE125933 T_TBM_STOCK_OUTIN_A201505129513 tmp_STOCK_BATCH_TYPE2919955 T_TBM_STOCK_OUTIN_DETAIL_A20150517114 T_TBM_CACHE_PUR_PRO277326 T_TBM_PATCH_PLATE_STRUCT_151130622 tmp00213255249 T_TBM_STOCK_TERM_STATISTICS1249 T_TBM_INFO_HISTORY13156 T_TBM_PICK_A201505255 STOCK_SAMPLE_DOWN_TEMP46577 T_TBM_PATCH_PLATE_STRUCT_BAK_15113037523 T_TBM_PICK_DETAIL_A20150510 T_MDM_CHAN_DISTRIBUTOR_INFO_20150602622 签收单物料编码异常信息表323518 tmp_STOCK_BATCH_TYPE3421 T_TBM_SAMPLE_UP_A201505786553 T_TBM_SALE_BILL51049 T_TBM_RETURN648 tmp00385 tmp_STOCK_PROBLEM1604 T_TBM_SAMPLE_UP_DETAIL_A2015051 T_TBM_ECBILL_DETAIL2016011811 tmp0041574982 T_TBM_STOCK_BATCH_bak74991 T_TBM_MESSAGE_DETAIL_20150731_BAK338 T_TBM_SAMPLE_DOWN_A2015051 T_TBM_ECBILL20160118169763 T_TBM_SALE_BILL_BAK_201507302128 T_TBM_SAMPLE_DOWN_DETAIL_A2015058752264 T_TBM_MY_PRODUCT75449 T_TBM_MESSAGE_DETAIL_150731_1530_bak4 T_TBM_STOCK_ALLOT_A20150544 T_TBM_ASSIGN_BAK14 T_TBM_STOCK_ALLOT_DETAIL_A2015054 T_TBM_PATCH_PLATE_STRUCT_20150825_BAK10852 T_TBM_CHECK_A2015051033569 TMP_TBM_SIGN_IN_COPY1199105 T_TBM_CHECK_DETAIL_A2015050 F_STOCK_SALE_UNSEND181727 T_TBM_SYNC_SHOP_PRICE165380 TMP_TBM_SIGN_IN_COPY_17380 T_TBM_SIGN_IN_A20150511550 T_TBM_CHECK_DETAIL20160302332198 T_TBM_PURBILL1354 T_TBM_COMMUNITY_SAD0 F_PUR_PACK_CHOICE75320 t_tbm_customer_bak350387 T_TBM_SIGN_IN_DETAIL_A20150580 T_TBM_PUR_DRAFT_BAK_00155 T_TBM_PUR_DRAFT_BAK_0021428794 T_TBM_STOCK_OUTIN_RECORD_B2015061 T_TBM_SIGN_IN_2015120873061 T_TBM_STOCK_OUTIN_B2015062 T_TBM_SIGN_IN_DETAIL20151208801882 TMP_TBM_SIGN_IN_COPY_21216594 T_TBM_STOCK_OUTIN_DETAIL_B201506618 TEMP_STOCK2387973 T_TBM_MESSAGE825411 T_TBM_PATCH_RECORD_15102743668 T_TBM_PICK_B2015060 F_STOCK_NEED1657 T_TBM_SAMPLE_UP_B20150615181 T_TBM_SAMPLE_UP419864 T_TBM_MESSAGE_DETAIL6479 T_TBM_SAMPLE_UP_DETAIL_B201506162553 T_TBM_EC_LOGISTIC13 T_MDM_PRO_PRODUCT_GROUP532 T_TBM_STOCK_PROBLEM25215 T_MDM_CHAN_SHOP_DEC_DETAIL966 T_TBM_SAMPLE_DOWN_B201506313806 T_TBM_ECBILL2 CAP_RESAUTH201601192840 T_TBM_SAMPLE_DOWN_DETAIL_B201506745046 T_TBM_ECBILL_DETAIL1084 T_MDM_PRO_MATERIAL_GROUP7975 T_TBM_SALE_BILL_20151214165380 TMP_TBM_SIGN_IN_COPY_35 T_TBM_STOCK_ALLOT_B201506720 T_TBM_SALE_BILL_201512152868 T_MDM_CHAN_SHOP_DEC_MAIN49 T_TBM_STOCK_ALLOT_DETAIL_B20150640804 T_TBM_WARCARD_bak5 T_MDM_PRO_SPACE_INFO0 F_SBILL_SALEORG1996 T_TBM_PUR_DRAFT81134 T_TBM_MESSAGE_DETAIL_20150803_bak9613 T_TBM_CHECK_B2015069480145 T_TBM_STOCK_BATCH555014 T_TBM_CHECK_DETAIL_B201506139900 BASE_PRODUCTINFO_BAK42200 T_TBM_PUR_DRAFT_DETAIL11451 T_TBM_SIGN_IN_B20150635817 T_MDM_PRO_PRODUCT_INFO_chayi579873 T_TBM_SIGN_IN_DETAIL_B2015060 T_TBM_CUSTOMER_FILE1428794 T_TBM_STOCK_OUTIN_RECORD_A2015062983 T_TBM_DIS_STORE_TEMP75485 T_TBM_STOCK_OUTIN_A201506422 T_TBM_DIS_STORE_TEMP11222711 T_TBM_STOCK_OUTIN_DETAIL_A20150645682 T_TBM_PICK_A201506284 T_TEMP_154849 T_TBM_CHECK96840 T_TBM_RETURN_DETAIL130733 T_TBM_PICK_DETAIL_A2015061046 T_TBM_COMMUNITY52 T_TEMP_IMP_2117931 T_TBM_PURBILL_201509111727 T_TBM_SAMPLE_UP_A2015061390504 T_TBM_PURBILL_DETAIL_201509110 T_TBM_SALES_RICE6468 T_TBM_SAMPLE_UP_DETAIL_A201506201 T_TEMP_2691322 T_TBM_WARCARD579 T_MDM_CHAN_CUSTOMER_MGR_INFO1052 T_TBM_SAMPLE_DOWN_A201506417 T_TBM_STAFF_SAD1099798 T_TBM_SALE_BILL_DETAIL201601222906 T_TBM_SAMPLE_DOWN_DETAIL_A2015062747 T_MDM_CHAN_DISTRIBUTOR_INFO_20150723_BAK1526570 T_TBM_SALE_BILL_DETAIL_SUIT201601223029 T_MDM_CHAN_DISTRIBUTOR_INFO6 T_TBM_STOCK_ALLOT_A2015064045718 T_TBM_SALE_BILL_DETAIL_PACK201601220 F_STOCK_HIS_SALES2559330 T_TBM_SALE_BILL_DETAIL25659 CAP_PARTYAUTH_BAK23136 T_TBM_SAMPLE_DOWN_DETAIL50 T_TBM_STOCK_ALLOT_DETAIL_A2015064045718 T_TBM_SALE_BILL_DETAIL_PACK_MATYPE_201601224812 T_MDM_CHAN_DIS_SALEORG_INFO9622 T_TBM_CHECK_A201506
数据库结构
http://**.**.**.**/default/1.jspx 9635789
shell
危害等级:高
漏洞Rank:13
确认时间:2016-04-04 22:39
CNVD确认所述情况,已经由CNVD通过网站公开联系方式向网站管理单位通报。
暂无