当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0171039

漏洞标题：武汉万科SQL注入可致70万微博用户信息泄露

相关厂商：万科集团

漏洞作者： abb

提交时间：2016-01-19 11:50

修复时间：2016-03-05 09:52

公开时间：2016-03-05 09:52

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-19： 细节已通知厂商并且等待厂商处理中
2016-01-22： 厂商已经确认，细节仅向厂商公开
2016-02-01： 细节向核心白帽子及相关领域专家公开
2016-02-11： 细节向普通白帽子公开
2016-02-21： 细节向实习白帽子公开
2016-03-05： 细节向公众公开

简要描述：

RT

详细说明：

http://**.**.**.**/default/


11.png


**.**.**.**    **.**.**.**


12.png


http://**.**.**.** /app/login.asp?work=UserLoginCk


13.png


current user:    'vankehui'
current database:    'vankehui'


available databases [14]:
[*] aaa
[*] apptest
[*] distribution
[*] master
[*] model
[*] msdb
[*] tempdb
[*] VankeAgenSMS
[*] vankeapp11
[*] vankehui2012
[*] VankeSMS
[*] VankeStat2009
[*] VankeStatHistory
[*] VankeStatistic


Database: vankehui
[707 tables]
+------------------------------------------+
| 2010May                                  |
| 51teambuylist                            |
| 8YearsSeason5                            |
| 8YearsSeason6                            |
| Action_new10_2013                        |
| ActiveGift2009Order                      |
| ActiveGift2009Product                    |
| ActivityCy                               |
| Activityjl                               |
| AdminUserLoginHistory                    |
| AdminUserLoginHistory                    |
| Admin_Role                               |
| Admin_Role                               |
| AdsGateway                               |
| AdsOutClass                              |
| AdsOutList                               |
| AllocationTo                             |
| ApplyIntegral                            |
| ArborDay2010                             |
| ArborDay2011                             |
| AuctionDemo                              |
| AuctionHistory                           |
| AuctionLang                              |
| Auction_Ware                             |
| AuthorList                               |
| BBSIDlist                                |
| BabyDiaryList                            |
| BabyDiaryList                            |
| BabyDiaryView                            |
| BabyList                                 |
| BabyListView                             |
| BabyShow                                 |
| BabyShowView                             |
| BabyShowVote                             |
| BaishazhouVote                           |
| BaoXiuMail                               |
| BaoXiuMail                               |
| BigBang2012_act01                        |
| Blessing                                 |
| BookShopMemberOrder                      |
| BookShopMemberOrder                      |
| BookShopUserOrder                        |
| BookShopUserOrder                        |
| Carnival2008                             |
| ChangePresent                            |
| ChefVote                                 |
| ChildrenDay2012_weibo_repost             |
| ClassList                                |
| Complaints                               |
| ContactLog                               |
| CountApplyIntegral                       |
| CrossOver                                |
| Dv_Appraise                              |
| Dv_BbsLink                               |
| Dv_BbsNews                               |
| Dv_BestTopic                             |
| Dv_BoardPermission                       |
| Dv_BoardPermission                       |
| Dv_Boke_KeyWord                          |
| Dv_Boke_Post                             |
| Dv_Boke_Skins                            |
| Dv_Boke_SysCat                           |
| Dv_Boke_System                           |
| Dv_Boke_Topic                            |
| Dv_Boke_Upfile                           |
| Dv_Boke_UserCat                          |
| Dv_Boke_UserCat                          |
| Dv_Boke_UserSave                         |
| Dv_BookMark                              |
| Dv_ChallengeInfo                         |
| Dv_ChanOrders                            |
| Dv_Friend                                |
| Dv_GroupName                             |
| Dv_GroupUser                             |
| Dv_Group_Board                           |
| Dv_Group_Class                           |
| Dv_Group_Topic                           |
| Dv_Group_bbs                             |
| Dv_Log                                   |
| Dv_Message                               |
| Dv_MoneyLog                              |
| Dv_Online                                |
| Dv_Plus_Tools_Buss                       |
| Dv_Plus_Tools_Buss                       |
| Dv_Plus_Tools_Info                       |
| Dv_Plus_Tools_MagicFace                  |
| Dv_Qcomic                                |
| Dv_Setup                                 |
| Dv_SmallPaper                            |
| Dv_Space_skin                            |
| Dv_Space_user                            |
| Dv_StyleHelp                             |
| Dv_TableList                             |
| Dv_Templates                             |
| Dv_Topic                                 |
| Dv_Upfile                                |
| Dv_UserAccess                            |
| Dv_UserAccess                            |
| Dv_UserGroups                            |
| Dv_Usertemp                              |
| Dv_Vote                                  |
| Dv_VoteUser                              |
| Dv_admin                                 |
| Dv_bbs2                                  |
| Dv_bbs3                                  |
| Dv_bbs4                                  |
| Dv_bbs5                                  |
| Dv_bbs6                                  |
| Dv_bbs7                                  |
| Dv_bbs8                                  |
| Dv_bbs9                                  |
| Dv_help                                  |
| ElementsReg2                             |
| ElementsReg2                             |
| Event2014_WordCup_Dictionary             |
| Event2014_WordCup_QuizConfing            |
| Event2014_WordCup_QuizList               |
| Event2014_WordCup_QuizResult             |
| Event2014_WordCup_Schedule               |
| Event2014_WordCup_Teamlist               |
| Event2014_WordCup_User                   |
| Event2014_WordCup_goodsexchange          |
| Event2014_WordCup_goodsexchange          |
| Event2014_WordCup_score                  |
| Event2015_App_Redpack_Scores             |
| Event2015_App_Redpack_Users              |
| Event2015_SignUp                         |
| Event_2011ChoujCy_Gg                     |
| Event_2011ChoujCy_Gg                     |
| Event_2011ChoujCy_message                |
| Event_2012_YunJing_ProductList           |
| Event_2012_YunJing_StageList             |
| Event_201361_Gift                        |
| Event_201361_Info                        |
| Event_2014cup_Imgdata                    |
| Event_2014dzp_info                       |
| Event_2014dzp_neibu                      |
| Event_2014dzp_prize                      |
| Event_2014music_info                     |
| Event_2014music_info                     |
| Event_Ad20130618                         |
| Event_Charm66JoinMember                  |
| Event_Christmas2012Log                   |
| Event_Christmas2012Prize                 |
| Event_Dance2011                          |
| Event_Dream2011                          |
| Event_GoldCity2012_renchou               |
| Event_GoldCitySOHO2012                   |
| Event_GoldenCityad07172012               |
| Event_Groupon2011Mail                    |
| Event_Groupon2011Mail                    |
| Event_GrouponInfo                        |
| Event_HKLegend_AnswerPeopleList          |
| Event_HappyIsland2012                    |
| Event_HappyIsland2012Xls                 |
| Event_HappyPinglun_2011                  |
| Event_HappySend2012_Member               |
| Event_HappySend2012_Member               |
| Event_HappySend2012_Readytobuy           |
| Event_HappySign_2011                     |
| Event_HappyVoteInfo_2011                 |
| Event_HappyVote_2011                     |
| Event_HotGuest                           |
| Event_Jscsask1108                        |
| Event_LoveVanke_2011                     |
| Event_MLXC_2014                          |
| Event_Mather2011                         |
| Event_MatherRemainSay                    |
| Event_MothersDayVideo                    |
| Event_Movie2014_List                     |
| Event_Movie2014_MoiveArea                |
| Event_Movie2014_votelog                  |
| Event_NewYear2014_JoinList               |
| Event_NewYear2014_PrizeList              |
| Event_Olympic2012_jl                     |
| Event_Olympic2012_jl                     |
| Event_Pal                                |
| Event_PrivateHomeCuisine2013_JoinList    |
| Event_PrivateHomeCuisine2013_MessageList |
| Event_PrivateHomeCuisine2013_NumberList  |
| Event_PrivateHomeCuisine2013_VoteList    |
| Event_RegisterMember_jylw                |
| Event_ScratchLog                         |
| Event_ServiceStar2013_PriceLog           |
| Event_ServiceStar2013_PriceLog           |
| Event_ServiceStar2013_PriceSet           |
| Event_ServiceStar2013_VoteLog            |
| Event_SingerOnline2012                   |
| Event_Sunruixue2012                      |
| Event_TheWorldCupGame                    |
| Event_TheWorldCupGuessRecord             |
| Event_TheWorldCupJoinMember              |
| Event_Tuan_QuestList                     |
| Event_Tuan_UserWeiboKeyWord              |
| Event_Tuan_UserWeiboList                 |
| Event_Vmovie2012_Msg                     |
| Event_Vmovie2012_Prize                   |
| Event_VppWork2                           |
| Event_VppWork2                           |
| Event_bookproject_2013                   |
| Event_dengji_zyw_2015                    |
| Event_dianyingzhan2012                   |
| Event_education2013                      |
| Event_guanggu2013_News                   |
| Event_guanggu2013_News                   |
| Event_guanggu2013_Score                  |
| Event_guanggu2013_Type                   |
| Event_guojifan_2012                      |
| Event_hanyanglovePinglun_2012            |
| Event_hanyanlove_2012                    |
| Event_happiness_info                     |
| Event_happiness_log                      |
| Event_hkcoffee_2013                      |
| Event_hkcqdj_2013                        |
| Event_hygjLove_2012                      |
| Event_jiayou2011                         |
| Event_jiayuan_2014                       |
| Event_jscschoujiang2012                  |
| Event_jscsdj_2013                        |
| Event_lyric_2012                         |
| Event_mdl2013Gezi                        |
| Event_mdl2013PrizeLog                    |
| Event_mdl2013PrizeLog                    |
| Event_mdl2013PrizeRound                  |
| Event_mdl2013PrizeUser                   |
| Event_qiangpiao2014_Records              |
| Event_qianren2013                        |
| Event_tuangou10_2011                     |
| Event_valentine2012                      |
| Event_viGuessRecord                      |
| Event_viTheWorldCupJoinMember            |
| Event_wing2013Extra                      |
| Event_wing2013Extra                      |
| Event_wing2013Normal                     |
| Event_wkjc_2013                          |
| Event_wxjf_book                          |
| Event_wxjf_bookset                       |
| Event_zaiyiqi_2014                       |
| Experience08                             |
| FeiChengWuRaoVote                        |
| FeiChengwuraoGuest                       |
| FromList                                 |
| Functiones                               |
| FundListCount                            |
| FundListCount                            |
| FundListView                             |
| Fundadd                                  |
| Games2008MC                              |
| Games2008MC                              |
| Games2008Open                            |
| GiftMall                                 |
| GiftSendedDetail                         |
| GoldMedal2008Guess                       |
| GoldenCityReg2                           |
| GoldenCityReg2                           |
| GoldenHomeLoft                           |
| Golden_banner2012                        |
| Golden_integral                          |
| Golden_present2012                       |
| Golden_userInfo2012                      |
| Goldmedal2008End                         |
| GolfCollegePic                           |
| GolfCollegeVote                          |
| GolfReg                                  |
| GolfSpring2009Config                     |
| GolfSpring2009Config                     |
| GreenBookSeat                            |
| HanYangGuoJiDengGi2013                   |
| HappySummerReg                           |
| HomePro2009                              |
| HouseCenterArea                          |
| HouseCenterArea                          |
| HouseCenterCase                          |
| HouseCenterList                          |
| InsertList                               |
| IpodGift                                 |
| IpodGiftSeat                             |
| Jindu                                    |
| JobList                                  |
| JobMail                                  |
| JobReplyList                             |
| JobReplyList                             |
| LD_User                                  |
| Laisee                                   |
| LaiseeSeat                               |
| Links                                    |
| LivingPodThree                           |
| LivingPodVote                            |
| LivingpodEight                           |
| LivingpodFive                            |
| LivingpodFour                            |
| LivingpodNine                            |
| LivingpodSeven                           |
| LivingpodSix                             |
| LivingpodTwo                             |
| LoginLock                                |
| LoginWrongLog                            |
| LotteryAward                             |
| LotteryJoinList                          |
| LotteryListView                          |
| LotteryProduct                           |
| LoveStory_2012                           |
| ML_GroupBuy                              |
| ML_GroupVote                             |
| MaYiReg                                  |
| MagazineOrderList                        |
| MagazineOrderList                        |
| MagazineVote                             |
| MailList                                 |
| ManagementFeePrintHistory                |
| ManagementFeePromotions                  |
| MarketAnalysisGroup                      |
| MarketAnalysisGroup                      |
| MarketAnalysisImport                     |
| MarketAnalysisIndex                      |
| MarketAnalysisList                       |
| MarketAnalysisUser                       |
| MarketCenter                             |
| MemberActiveScores                       |
| MemberBBSInfo                            |
| MemberCaseCount                          |
| MemberCaseCount                          |
| MemberCaseUpdate                         |
| MemberComplaintDetail                    |
| MemberComplaintDetail                    |
| MemberDele                               |
| MemberDelivers                           |
| MemberGoldenTypeHistory                  |
| MemberImport                             |
| MemberInfoChangeList                     |
| MemberSatisfaction                       |
| MemberUpdateGolden                       |
| Member_Birthday                          |
| Member_Birthday                          |
| Membercaseurl                            |
| More2008                                 |
| More2008Vote                             |
| Music2009_Form                           |
| Music2009_FormView                       |
| News_Keyword                             |
| News_Keyword                             |
| News_Speciality                          |
| News_Template                            |
| NoticeCardPost                           |
| NoticeMaster                             |
| NoticeMemberCard                         |
| NoticeProduct                            |
| NoticePutUp                              |
| Order_2013_goods                         |
| Order_2013_goodtype                      |
| Order_2013_list                          |
| Order_2013_mingxi                        |
| Order_2013_part                          |
| Order_2013_qiandao                       |
| Order_2013_sysconfing                    |
| Order_2013_user                          |
| OrientalBookOrder                        |
| OrientalUser                             |
| P_VouchersMember                         |
| P_VouchersOrderList                      |
| P_VouchersOrderList                      |
| P_VouchersParent                         |
| P_VouchersProduct                        |
| ParadisoReg                              |
| Pioneer2009                              |
| PioneerBookBus                           |
| PioneerBookBus                           |
| PioneerBookOrder                         |
| PioneerBookOrderTotal                    |
| PioneerFilmList                          |
| PioneerFilmList                          |
| PioneerFilmOrder                         |
| PioneerFilmVote                          |
| PioneerMobileJoin                        |
| PrizeThingsjyhf                          |
| PrizeThingsjyhf                          |
| ProjectPrice                             |
| ProjectProgress                          |
| RS_Song                                  |
| RS_dvd                                   |
| RecordSrch                               |
| SalesShow                                |
| SayLove_JoinMember                       |
| SayLove_Record                           |
| ScoresCycle                              |
| ScoresDetails_1                          |
| ScoresDetails_1                          |
| ScoresDetails_Before34                   |
| ScoresDetails_Minus_1                    |
| ScoresDetails_Minus_1                    |
| ScoresDetails_bak20130701                |
| ScoresDetails_weibo_temp                 |
| ScoresDetails_weibo_temp                 |
| ScoresNegative                           |
| ScoresPrintHistory                       |
| Sgin_bbjx_dengji                         |
| Sgin_bbjx_votes                          |
| Sgin_movie2011_dengji                    |
| ShangJia_FAQ                             |
| ShangJia_FAQ                             |
| ShangJia_Product                         |
| Sheet1$                                  |
| Sign_taobao_2011                         |
| Spring2009                               |
| Spring2009vanke                          |
| TS_AdminFile                             |
| TS_AdminFile                             |
| TS_AdminLog                              |
| TS_BindingHistory                        |
| TS_BindingHistory                        |
| TS_ExamAnswer                            |
| TS_ExamAnswer                            |
| TS_ExamClass                             |
| TS_ExamQuestion                          |
| TS_Sales                                 |
| TS_TeamManagerHistory                    |
| TS_TeamManagerHistory                    |
| TeamBuyList                              |
| TeamBuyList                              |
| TeamBuyReport                            |
| Ticket2007III                            |
| Ticket2007III                            |
| Ticket2007III                            |
| Ticket2007IIuser                         |
| Ticket2007ListIII                        |
| Ticket2007ListIII                        |
| Ticket2007ListIII                        |
| Ticket2008Movie                          |
| Ticket2008Movie                          |
| TouGao                                   |
| Tuan_GameAlog                            |
| Tuan_LoginLog                            |
| Tuan_My_statuses_2013                    |
| Tuan_My_statuses_repost_2013             |
| Tuan_proess_see                          |
| Tuan_user_2013                           |
| Tuan_weibouser_2013                      |
| Tuan_weibouser_Relation_2013             |
| UsersFunction                            |
| UsersFunction                            |
| UsonianReg2                              |
| UsonianReg2                              |
| VIEW1                                    |
| V_Event2014_WordCup_QuizList             |
| V_Event2014_WordCup_Schedule             |
| V_Order_2013_goods                       |
| V_Order_2013_list                        |
| V_Order_2013_mingxi                      |
| V_Order_2013_qiandao                     |
| V_Order_2013_user                        |
| V_PrivateHomeCuisine2013_MessageList     |
| V_YunJing_Product_List                   |
| V_event_qprecord                         |
| V_qpuser2012                             |
| V_sign_smilesListzy2012                  |
| ValentineDay0214_record                  |
| VankeCityReg2                            |
| VankeCityReg2                            |
| VankeCompany                             |
| VankeDict                                |
| VankeLifeDetail                          |
| VankeLifeDetail                          |
| VankeMailLog                             |
| VankeSMSLog                              |
| VankeSmsBlack                            |
| View_AdminInfo                           |
| View_Birthday                            |
| View_Christmas2012Log                    |
| View_Event_Mdl2003PrizeLog               |
| View_Event_QiangPiaoUser                 |
| VisitorComment                           |
| VoteAnswer                               |
| VoteQuestion                             |
| Vote_class                               |
| WorkHistory                              |
| Xmas2008Order                            |
| Xmas2008OrderStatu                       |
| Xmas2008Product                          |
| Xmas2008ProductTemp                      |
| Xmas2009Order                            |
| Xmas2009Product                          |
| Youth2                                   |
| Event_wing2013GUID                       |
| case                                     |
| aaa                                      |
| active2011_wenjuan                       |
| active2011_zhufucontent                  |
| active2011_zhufuuser                     |
| active_Ipad                              |
| active_message                           |
| active_singapore                         |
| ant2008                                  |
| assembly_reg                             |
| babyReview                               |
| badmintonVote_2011                       |
| bbjx_dhjhj_2011                          |
| bbjx_hyjhhj_2011                         |
| bbjx_liuliang_2011                       |
| bbjx_qmzhj_2011                          |
| bbjx_tphdhj_2011                         |
| bbjx_vksj_2011                           |
| cheatsite                                |
| cms_AdvertClasses                        |
| cms_Adverts                              |
| cms_Authors                              |
| cms_DynamicTemplates                     |
| cms_Keyswords                            |
| cms_MailAddressTypes                     |
| cms_MailAddresses                        |
| cms_MailConfigs                          |
| cms_MailLogs                             |
| cms_NewsAgrees                           |
| cms_NewsAgrees                           |
| cms_NewsClasses                          |
| cms_NewsCommentAgrees                    |
| cms_NewsComments                         |
| cms_NewsPagings                          |
| cms_NewsSources                          |
| cms_NewsTemplates                        |
| cms_PageTemplates                        |
| cms_Specialities                         |
| cms_StaticTemplates                      |
| dengjiTB                                 |
| diarycounts                              |
| dtproperties                             |
| dv_bbs1                                  |
| event_2012hygj_list                      |
| event_2012wkyfz_list                     |
| event_72hour_2012                        |
| event_Olympic2012news_2012               |
| event_ValentineDay_2012                  |
| event_WKmusic_2012                       |
| event_classroom_2012                     |
| event_dbzdj_2012                         |
| event_dbzmusic_2012                      |
| event_dbzno_2012                         |
| event_gaojia                             |
| event_guolewujiang2011                   |
| event_hygj2012_shitu                     |
| event_hygj2012_users                     |
| event_hygjganen2012_qiao                 |
| event_hygjganen2012_qiao                 |
| event_hygjganen2012_xy                   |
| event_hygjxxtp_2011                      |
| event_lanwanchoujiang2014_info           |
| event_lanwanchoujiang2014_prize          |
| event_lpdxy_2012                         |
| event_mooncake_2014                      |
| event_qprecord                           |
| event_qpsite                             |
| event_qpuser2012                         |
| event_qpuserlist                         |
| event_questionnaire_2012                 |
| event_sdgyName_2012                      |
| event_whvankesp_2012                     |
| event_whvankeyd_2012                     |
| event_xfjzjqc_2012                       |
| event_ygxkfdj_2012                       |
| event_ygxrs_2012                         |
| game201102_user                          |
| game2011_user                            |
| goldmedal2008_temp                       |
| goldmedal2008_temp                       |
| hfweb_book                               |
| hfweb_colligate                          |
| hfweb_item                               |
| hfweb_vote                               |
| jQuestion                                |
| jiehun2012_votes                         |
| jilujyhf                                 |
| jilujyhf                                 |
| jinsekaipan2013                          |
| jsfeedback_Participate                   |
| jsfeedback_default                       |
| jsfeedback_winning                       |
| jsgw2011_wenjuan                         |
| messages_2012                            |
| motherday2012_weibo_repost               |
| nQuestion                                |
| nickname                                 |
| prizeUserjyhf                            |
| prizeUserjyhf                            |
| registerjyhf                             |
| registerwh                               |
| renchou                                  |
| repostlist                               |
| repostscores                             |
| sagin_BigBang2012_app                    |
| sagin_BigBang2012_apptoupiao             |
| sagin_whggkjscs_2012                     |
| sgin_Answer2012                          |
| sgin_BigBang2012                         |
| sign_AprilFlower_2012                    |
| sign_CarWash2012                         |
| sign_Hongregin2011                       |
| sign_RmalLife2012                        |
| sign_baby2012zy                          |
| sign_baoming2011                         |
| sign_gangxu2012                          |
| sign_gunshi2012                          |
| sign_guole2011                           |
| sign_guole2011                           |
| sign_haitong2012                         |
| sign_jiehun2012zy                        |
| sign_neiding                             |
| sign_photo2012s                          |
| sign_prizeguole2011                      |
| sign_regin2011                           |
| sign_smilesListzy20121                   |
| sign_smilesListzy20121                   |
| sign_vMovie2012ZP                        |
| signup_WKfchdj_2011                      |
| signup_WKhanyangguoji_2011               |
| signup_WKhongjunchengjuxi_2011           |
| signup_WKjinsechengshi_2011              |
| signup_WKqinshuiyouyue_2012              |
| signup_hygjhjxx1_2011                    |
| signup_hygjhjxx2_2011                    |
| signup_hygjxxdj_2011                     |
| smile20121View                           |
| smilesPrize                              |
| smileszy2012_votes                       |
| spring2011                               |
| sys_AccountLogs                          |
| sys_AccountRoles                         |
| sys_Accounts                             |
| sys_Dictionary                           |
| sys_Functions                            |
| sys_Logs                                 |
| sys_RoleFunctions                        |
| sys_Roles                                |
| sys_SMSLog                               |
| tbl_AuctionClass                         |
| tbl_AuctionGoods                         |
| tbl_AuctionHuodong                       |
| tbl_AuctionRecord                        |
| tbl_merchantInfo                         |
| temp_Pal                                 |
| temp_score                               |
| tsys_PageContentInsert                   |
| tsys_pageclass                           |
| tsys_pageclass                           |
| tsys_pagenews                            |
| tuan_money_log                           |
| tuanlinshi                               |
| tuanuserallcoutbytime                    |
| tuanuserallcoutbytime                    |
| tuanuserallcoutbytime                    |
| tuanusercoutbytime                       |
| tuanusercoutbytime                       |
| userdy                                   |
| userdy                                   |
| v_ChildrenDay2012_weibo_repost           |
| v_HaiTong2012                            |
| v_bbb1                                   |
| v_cccc                                   |
| v_lishi                                  |
| v_motherday2012_weibo_repost             |
| v_tuan_money_log                         |
| vanke_My_statuses_repost                 |
| vanke_My_statuses_repost                 |
| view_AllNewsInfo                         |
| view_NewsInfo2                           |
| view_NewsInfo2                           |
| vip_ScoreGiftCycles                      |
| vip_ScoreGiftOrders                      |
| vip_ScoreGiftParts                       |
| vip_ScoreGifts                           |
| vks                                      |
| vote_2012_info                           |
| vote_2012_info                           |
| vote_2012_info                           |
| votes                                    |
| vw_Event2015_App_Redpack_Scores          |
| vw_Event2015_App_Redpack_Users           |
| vw_GoldMemberType                        |
| vw_MemberCase_Case_Last                  |
| vw_MemberCase_Last                       |
| vw_MemberSatisfaction                    |
| vw_MemberUpdate_Address                  |
| vw_MemberUpdate_Phone                    |
| vw_ScoresDetails                         |
| vw_cms_Adverts                           |
| vw_cms_MailAdresses                      |
| vw_cms_News                              |
| web_Process                              |
| web_Service                              |
| weibo_userrepost                         |
| wkh_weibo_user                           |
| wkh_weibo_user                           |
| wx_Activity                              |
| wx_ActivityRecords                       |
| wx_ActivityTemplates                     |
| wx_AnswerItems                           |
| wx_ApiUsers                              |
| wx_AppConfigs                            |
| wx_Apps                                  |
| wx_Contacts                              |
| wx_FAQs                                  |
| wx_GuestBooks                            |
| wx_Messages                              |
| wx_NewsResources                         |
| wx_PublicAccounts                        |
| wx_Qrcodes                               |
| wx_TemplateMessages                      |
| xfreg2011                                |
| zk                                       |
+------------------------------------------+


Database: vankehui
+----------------------------------------------+---------+
| Table                                        | Entries |
+----------------------------------------------+---------+
| dbo.Tuan_weibouser_Relation_2013             | 831182  |
| dbo.Tuan_weibouser_2013                      | 692951  |
| dbo.tuanuserallcoutbytime                    | 692951  |
| dbo.tuanuserallcoutbytime                    | 692951  |
| dbo.tuanuserallcoutbytime                    | 692951  |
| dbo.tuanusercoutbytime                       | 692951  |
| dbo.tuanusercoutbytime                       | 692951  |
| dbo.tuan_money_log                           | 570667  |
| dbo.v_tuan_money_log                         | 570667  |
| dbo.dv_bbs1                                  | 355900  |
| dbo.Dv_bbs8                                  | 276678  |
| dbo.MemberInfoChangeList                     | 261440  |
| dbo.Dv_bbs4                                  | 260292  |
| dbo.Dv_bbs7                                  | 227930  |
| dbo.Dv_bbs6                                  | 219426  |
| dbo.ScoresDetails_1                          | 217358  |
| dbo.ScoresDetails_1                          | 217358  |
| dbo.ScoresDetails_bak20130701                | 199731  |
| dbo.ScoresDetails_Before34                   | 199360  |
| dbo.Dv_bbs3                                  | 180964  |
| dbo.vanke_My_statuses_repost                 | 177878  |
| dbo.vanke_My_statuses_repost                 | 177878  |
| dbo.Dv_Topic                                 | 170695  |
| dbo.Dv_bbs2                                  | 170305  |
| dbo.SayLove_Record                           | 167832  |
| dbo.Dv_bbs5                                  | 138198  |
| dbo.Dv_Upfile                                | 121422  |
| dbo.Tuan_My_statuses_repost_2013             | 98413   |
| dbo.AllocationTo                             | 96653   |
| dbo.vw_ScoresDetails                         | 77189   |
| dbo.Member_Birthday                          | 76900   |
| dbo.Member_Birthday                          | 76900   |
| dbo.VankeSMSLog                              | 73727   |
| dbo.Event_PrivateHomeCuisine2013_VoteList    | 73150   |
| dbo.BabyShowVote                             | 63700   |
| dbo.Tuan_LoginLog                            | 62581   |
| dbo.ProjectProgress                          | 61000   |
| dbo.MemberCaseCount                          | 60993   |
| dbo.MemberCaseCount                          | 60993   |
| dbo.MemberCaseUpdate                         | 60921   |
| dbo.vw_MemberCase_Case_Last                  | 58658   |
| dbo.vw_MemberCase_Last                       | 57773   |
| dbo.v_lishi                                  | 57286   |
| dbo.Event_Tuan_UserWeiboList                 | 48059   |
| dbo.ScoresDetails_weibo_temp                 | 48011   |
| dbo.ScoresDetails_weibo_temp                 | 48011   |
| dbo.Dv_Log                                   | 42506   |
| dbo.Event_GoldCity2012_renchou               | 37410   |
| dbo.nickname                                 | 36179   |
| dbo.MemberBBSInfo                            | 34455   |
| dbo.vw_MemberUpdate_Address                  | 33275   |
| dbo.vw_MemberUpdate_Phone                    | 33095   |
| dbo.event_qpuser2012                         | 32992   |
| dbo.Dv_Appraise                              | 30619   |
| dbo.[Event_wing2013GUID ]                    | 30020   |
| dbo.V_qpuser2012                             | 28226   |
| dbo.MemberActiveScores                       | 27422   |
| dbo.Event_happiness_log                      | 24745   |
| dbo.Dv_Message                               | 23592   |
| dbo.VankeSmsBlack                            | 21989   |
| dbo.Event_TheWorldCupGuessRecord             | 18388   |
| dbo.Event_viGuessRecord                      | 18388   |
| dbo.MemberGoldenTypeHistory                  | 16214   |
| dbo.vw_GoldMemberType                        | 15452   |
| dbo.Jindu                                    | 14218   |
| dbo.Dv_VoteUser                              | 13772   |
| dbo.tuanlinshi                               | 13035   |
| dbo.Event_HappySend2012_Member               | 12950   |
| dbo.Event_HappySend2012_Member               | 12950   |
| dbo.NoticePutUp                              | 11215   |
| dbo.MemberSatisfaction                       | 10446   |
| dbo.Tuan_user_2013                           | 10363   |
| dbo.smileszy2012_votes                       | 10344   |
| dbo.Event2014_WordCup_QuizList               | 9089    |
| dbo.V_Event2014_WordCup_QuizList             | 9089    |
| dbo.MagazineOrderList                        | 8669    |
| dbo.MagazineOrderList                        | 8669    |
| dbo.ScoresDetails_Minus_1                    | 8615    |
| dbo.ScoresDetails_Minus_1                    | 8615    |
| dbo.AdsOutList                               | 7898    |
| dbo.LoveStory_2012                           | 7884    |
| dbo.Dv_Usertemp                              | 7758    |
| dbo.vw_MemberSatisfaction                    | 7647    |
| dbo.Event_Olympic2012_jl                     | 6959    |
| dbo.Event_Olympic2012_jl                     | 6959    |
| dbo.BabyDiaryView                            | 6857    |
| dbo.BabyDiaryList                            | 6853    |
| dbo.BabyDiaryList                            | 6853    |
| dbo.Sgin_bbjx_votes                          | 6485    |
| dbo.Event_HappySend2012_Readytobuy           | 6415    |
| dbo.event_qpuserlist                         | 6243    |
| dbo.Event2014_WordCup_score                  | 5866    |
| dbo.temp_score                               | 5865    |
| dbo.Dv_bbs9                                  | 5851    |
| dbo.view_AllNewsInfo                         | 5242    |
| dbo.LivingpodNine                            | 5153    |
| dbo.View_Event_QiangPiaoUser                 | 5129    |
| dbo.ParadisoReg                              | 5036    |
| dbo.Sgin_bbjx_dengji                         | 4967    |
| dbo.view_NewsInfo2                           | 4740    |
| dbo.view_NewsInfo2                           | 4740    |
| dbo.zk                                       | 4475    |
。。。。。。。


692951新浪微博用户信息泄露

14.png


可跨库：
Database: VankeStat2009
+--------------------------------------------------+---------+
| Table                                            | Entries |
+--------------------------------------------------+---------+
| dbo.address                                      | 287912  |
| dbo.Origin_Page                                  | 204924  |
| dbo.[View]                                       | 78936   |
| dbo.Client                                       | 58706   |
| dbo.Online                                       | 1204    |
| dbo.Site                                         | 4       |
+--------------------------------------------------+---------+


15.png

16.png


漏洞证明：

同上

修复方案：

过滤。。。。。。。

版权声明：转载请注明来源 abb@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2016-01-22 11:02

厂商回复：

CNVD确认并复现所述情况，已由CNVD通过网站管理方公开联系渠道向其邮件通报，由其后续提供解决方案。

最新状态：

暂无