当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-069252

漏洞标题:用友某站SQL注入漏洞一枚

相关厂商:用友软件

漏洞作者: 漫步云端

提交时间:2014-07-22 11:07

修复时间:2014-07-27 11:08

公开时间:2014-07-27 11:08

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-07-22: 细节已通知厂商并且等待厂商处理中
2014-07-27: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

RT.

详细说明:

站点:http://academy.yonyou.com


注入点:http://academy.yonyou.com/ViewCourseMap.aspx?infoid=15


111.jpg


22222.jpg


available databases [9]:
[*] master
[*] model
[*] msdb
[*] tempdb
[*] Timber_Exam_Gov
[*] Timber_Exam_YL
[*] Timber_Live
[*] Timber_PX_New_YY
[*] Timber_Tianming


Database: Timber_Exam_Gov
[230 tables]
+---------------------------------+
| AGENCY_INFO |
| APPLY_ALLOCATION_INFO |
| APPLY_CALLBACK_INFO |
| APPLY_CONSULT_INFO |
| APPLY_EDU_INFO |
| APPLY_LINK_CONSULT_CALLBACK |
| APPLY_LINK_CONSULT_DEP |
| APPLY_LINK_CONSULT_TYPE |
| APPLY_PASSPORT_INFO |
| APPLY_STU_INFO |
| CLICK_CLASS_INFO |
| CLICK_CW_INFO |
| CLICK_NEWS_INFO |
| CLICK_RATE_INFO |
| COURSE_QA_ASK_INFO |
| COURSE_QA_REPLY_INFO |
| CREDIT_ALLOT_INFO |
| CW_INFO |
| EXAM_CARD_INFO |
| EXAM_CATEGORY_INFO |
| EXAM_D_Q_KNOWLEDGE_TYPE_INFO |
| EXAM_D_Q_MODULE_INFO |
| EXAM_D_Q_STATE_INFO |
| EXAM_D_Q_TYPE_INFO |
| EXAM_LINK_P_Q |
| EXAM_LINK_P_Q_RANDOM |
| EXAM_LINK_P_T |
| EXAM_PAPER_INFO |
| EXAM_PLAN_DEP |
| EXAM_PLAN_INFO |
| EXAM_PLAN_POSITION |
| EXAM_PLAN_TCH |
| EXAM_PLAN_USER |
| EXAM_P_TYPE_INFO |
| EXAM_P_WAY_INFO |
| EXAM_QUESTION_EXTEND_INFO |
| EXAM_QUESTION_INFO |
| EXAM_RESULT_INFO |
| EXAM_RESULT_ROLE |
| EXAM_RESULT_ROLE_SUB |
| EXAM_TYPE_INFO |
| GOV_GOODS_INFO |
| GOV_GOODS_TYPE |
| GOV_HELP_INFO |
| GOV_HELP_TYPE_INFO |
| GOV_NEW_INFO |
| GOV_NEW_TYPE_INFO |
| GOV_NOTICE_INFO |
| GOV_NOTICE_TYPE |
| GOV_REGULATIONS_INFO |
| GOV_REGULATIONS_TYPE |
| GOV_WORK_INFO |
| MESSAGE_DRAFT_INFO |
| MESSAGE_INBOX_INFO |
| MESSAGE_NOTEBOOK_INFO |
| MESSAGE_NOTEBOOK_TYPE_INFO |
| MESSAGE_OUTBOX_INFO |
| NEW_INFO |
| NEW_TYPE_INFO |
| PORTALS_LINKS_INFO |
| PROMOTION_CODE_INFO |
| PX_ADMIN_COURSE |
| PX_ASK_COURSE |
| PX_ASK_FACE_COURSE |
| PX_CASE_INFO |
| PX_COURSEWARE_INFO |
| PX_COURSE_ASSESS_INFO |
| PX_COURSE_INFO |
| PX_COURSE_TYPE_INFO |
| PX_DOC_INFO |
| PX_EVALUATE_INFO |
| PX_FACE_COURSE_ASSESS_INFO |
| PX_FACE_COURSE_INFO |
| PX_LINK_CASE_PXTYPE |
| PX_LINK_COURSE_CASE |
| PX_LINK_COURSE_CW |
| PX_LINK_COURSE_DEP |
| PX_LINK_COURSE_DOC |
| PX_LINK_COURSE_NEWS |
| PX_LINK_COURSE_PLAN |
| PX_LINK_COURSE_POSITION |
| PX_LINK_COURSE_TCH |
| PX_LINK_COURSE_TYPE_DEP |
| PX_LINK_COURSE_USER |
| PX_LINK_CREDIT_INFO |
| PX_LINK_CW_PXTYPE |
| PX_LINK_DOC_PXTYPE |
| PX_LINK_FACE_COURSE_DEP |
| PX_LINK_FACE_COURSE_POSITION |
| PX_LINK_FACE_COURSE_USER |
| PX_LINK_NEWS_PXTYPE |
| PX_LINK_TCH_PXTYPE |
| PX_NEWS_INFO |
| PX_NOTE_INFO |
| PX_RECORD_USER_CASE_INFO |
| PX_RECORD_USER_CW_INFO |
| PX_RECORD_USER_DOC_INFO |
| PX_RECORD_USER_NEWS_INFO |
| PX_STUDENT_EXPRESSION_INFO |
| PX_STUDENT_EXPRESSION_TYPE_INFO |
| PX_TCH_INFO |
| PX_WORKS_INFO |
| Px_Info_Uploading_Info |
| QA_ASK_INFO |
| QA_ASK_TYPE |
| QA_REPLY_INFO |
| STUDENT_BASE_INFO |
| STUDENT_MAGOR_INFO |
| STUDENT_STU_INFO |
| SYSTEM_ICON_INFO |
| SYSTEM_LIMIT_INFO |
| SYSTEM_LINK_USER_ROLE |
| SYSTEM_MODULE_INFO |
| SYSTEM_ROLE_INFO |
| SYSTEM_ROLE_LIMIT |
| SYS_SEQUENCE |
| USER_BASE_INFO |
| USER_CREDIT_INFO |
| USER_DEP_INFO |
| USER_LOGIN_INFO |
| USER_ONLINE_INFO |
| USER_PARTNERS_INFO |
| USER_PARTNERS_SCHEDULE |
| USER_POSITION_INFO |
| USER_SERVICE_INFO |
| USER_STU_INFO |
| VOTE_BASE_INFO |
| VOTE_SUB_INFO |
| VOTE_TYPE_INFO |
| VOTE_USER_RECORD |
| V_APPLY_ALLOCATION_INFO |
| V_APPLY_CALLBACK_INFO |
| V_APPLY_CONSULT_INFO |
| V_APPLY_CONSULT_TYPE_INFO |
| V_APPLY_EDU_INFO |
| V_APPLY_LINK_CONSULT_CALLBACK |
| V_APPLY_PASSPORT_INFO |
| V_APPLY_STU_INFO |
| V_APPLY_STU_PARTICULAR |
| V_ASK_INFO |
| V_COUNT_1_INFO |
| V_COUNT_2_INFO |
| V_COUNT_3_INFO |
| V_COUNT_4_INFO |
| V_COURSE_APPLE |
| V_COURSE_CASE |
| V_COURSE_CREDIT_INFO |
| V_COURSE_CW |
| V_COURSE_DOC |
| V_COURSE_LINK_EPLAN_PLAN |
| V_COURSE_NEWS |
| V_COURSE_PLAN |
| V_COURSE_TCH |
| V_EVALUATE_USER |
| V_EXAM_LINK_P_T |
| V_EXAM_LINK_P_T_RANDOM |
| V_EXAM_MONITOR |
| V_EXAM_PAPER |
| V_EXAM_PAPER_CUSTOM |
| V_EXAM_PAPER_RANDOM |
| V_EXAM_PLAN_DEP |
| V_EXAM_PLAN_INFO |
| V_EXAM_PLAN_POSITION |
| V_EXAM_PLAN_TCH |
| V_EXAM_PLAN_USER |
| V_EXAM_QUEST_ERROR |
| V_GET_E_P_Q_CUSTOM |
| V_GET_E_P_Q_RANDOM |
| V_GOV_COURSE |
| V_GOV_EXAM_PLAN_INFO |
| V_GOV_FACE_COURSE |
| V_GOV_FACE_COURSE_ASSESS |
| V_GOV_GOODS_INFO |
| V_GOV_HELP_INFO |
| V_GOV_HELP_TYPE_INFO |
| V_GOV_NEW_INFO |
| V_GOV_NEW_TYPE_INFO |
| V_GOV_NOTICE_INFO |
| V_GOV_NOTICE_TYPE_INFO |
| V_GOV_REGULATIONS_INFO |
| V_LABOR_PLAN |
| V_L_PLAN_USER |
| V_MESSAGE_INBOX_INFO |
| V_NEW_INFO |
| V_NOTEBOOK_INFO |
| V_PAPER_INFO |
| V_PAPER_TYPE_QUESTION |
| V_PLAN_CARD |
| V_PLAN_MONITOR |
| V_PROMOTION_CODE_INFO |
| V_PX_COURSEWARE_INFO |
| V_PX_UPLOAD_INFO |
| V_QA_RIPLY_INFO |
| V_QUESTION_BASE_INFO |
| V_QUESTION_EXPORT_INFO |
| V_QUESTION_EXTEND_INFO |
| V_QUESTION_FULL_INFO |
| V_QUESTION_TYPE |
| V_REPORT_DEP_USER |
| V_REPORT_EXAM_PLAN_INFO |
| V_REPORT_EXAM_PLAN_USER |
| V_REPORT_EXAM_PLAN_USER_T |
| V_REPORT_KNOWLEDGE_QUESTION |
| V_REPORT_KNOWLEDGE_USING |
| V_REPORT_PLAN_DEP |
| V_REPORT_PLAN_DEP_INFO |
| V_REPORT_POSITION_USER |
| V_REPORT_TYPE_QUESTION |
| V_RESULT_CARD |
| V_STUDENT_STU_INFO |
| V_SYSTEM_LIMIT_INFO |
| V_SYSTEM_MODULE_INFO |
| V_TCH_STU_INFO |
| V_USER_BASE_INFO |
| V_USER_DEP_INFO |
| V_USER_EVALUATE_COURSE |
| V_USER_EXAM_PLAN_INFO |
| V_USER_EXAM_PLAN_INFO_JOIN |
| V_USER_EXAM_UNJOIN |
| V_USER_FULL_INFO |
| V_USER_ROLE_URL |
| V_USER_TEST_PLAN_INFO |
| V_USER_USAGERECORD_CASE |
| V_USER_USAGERECORD_CW |
| V_USER_USAGERECORD_DOC |
| V_USER_USAGERECORD_NEWS |
| V_USER_WORKS_INFO |
| V_VOTE_BASE_INFO |
| V_VOTE_USER_RECORD |
| dtproperties |
+---------------------------------+


漏洞证明:

如上.

修复方案:

版权声明:转载请注明来源 漫步云端@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2014-07-27 11:08

厂商回复:

最新状态:

暂无


漏洞评价:

评论