HanDs
NO.2

[7月漏洞公开] 安徽省环境保护厅SQL注入一枚/涉及OA系统数据库 





学习中请遵循国家相关法律法规,黑客不作恶。没有网络安全就没有国家安全

本站需要登陆后才能查看

rt

详细说明:

安徽省环境保护厅 http://**.**.**.**/



sql注入一枚 导致数据库泄露 包括OA系统



注入点 http://**.**.**.**:8080/WRYJG/STZXGK/show.aspx?NewsID=8



QQ截图20160522151052.jpg





QQ截图20160522151100.jpg





QQ截图20160522162737.jpg





QQ截图20160522162745.jpg





QQ截图20160522162756.jpg







Database: AepbWRYJG

[149 tables]

+-------------------------------------+

| dbo.AccountData |

| dbo.BaseInfo |

| dbo.CMS_Article |

| dbo.CMS_Article2 |

| dbo.CMS_Article454 |

| dbo.CMS_Article5555 |

| dbo.CMS_ArticleTemp |

| dbo.CMS_MenuChannel |

| dbo.CMS_MenuClass |

| dbo.CODE_Area |

| dbo.CODE_COAL |

| dbo.CODE_FACTSCALE |

| dbo.CODE_FACTTYPE |

| dbo.CODE_FACT_KIND |

| dbo.CODE_FACT_TYPE |

| dbo.CODE_FIRE_TYPE |

| dbo.CODE_HAVINGTYPE |

| dbo.CODE_POLLUTETYPE |

| dbo.CODE_POLLUTION_TABLE |

| dbo.CODE_TRADE |

| dbo.CODE_VALLY |

| dbo.DBSync_Aepb_ConnString |

| dbo.DBSync_Aepb_ConnString_X |

| dbo.DBSync_Aepb_Data |

| dbo.DBSync_Record_Data |

| dbo.DBSync_Record_Log |

| dbo.DT_SHJCJGML |

| dbo.D_GAS_EMITION_HOUR_DATA |

| dbo.D_WATER_EMITION_HOUR_DATA |

| dbo.Data_Dictionary |

| dbo.Data_Dictionary12 |

| dbo.Dictionary |

| dbo.DirectInfo_ReportChild |

| dbo.DirectInfo_ReportChild2 |

| dbo.JDXJC_Sync_View |

| dbo.JG_CityWCL |

| dbo.JG_Factor_Code |

| dbo.JG_Factor_Code1 |

| dbo.JG_Factor_Code2 |

| dbo.JG_Factor_Code3 |

| dbo.JG_Factor_Setting |

| dbo.JG_Gas_Data |

| dbo.JG_Gas_Data2 |

| dbo.JG_JCTJB |

| dbo.JG_JCTJBZD |

| dbo.JG_Polultion_Code |

| dbo.JG_WCLTJ |

| dbo.JG_WRY_PFSB |

| dbo.JG_Water_Data |

| dbo.JG_Water_Data2 |

| dbo.JG_ZDJCPZ |

| dbo.Noise_Data |

| dbo.Noise_Data2 |

| dbo.Noise_Function_Level |

| dbo.Noise_S_Station_Info |

| dbo.Noise_S_Station_Info2 |

| dbo.Noise_S_Station_Type |

| dbo.OA_Apps |

| dbo.OA_Function |

| dbo.OA_FunctionAcl |

| dbo.OA_Org |

| dbo.OA_PollutionAcl |

| dbo.OA_Role |

| dbo.OA_RoleUser_R |

| dbo.OA_SButton |

| dbo.OA_SYSLog |

| dbo.OA_SysConfig |

| dbo.OA_User |

| dbo.PMC_b_gas_emition |

| dbo.PMC_b_gas_emition_pollutant |

| dbo.PMC_b_pollution_info |

| dbo.PMC_b_water_emition |

| dbo.PMC_b_water_emition_pollutant |

| dbo.PMC_d_gas_emition_day_data |

| dbo.PMC_d_gas_emition_hour_data |

| dbo.PMC_d_gas_pollutant_day_data |

| dbo.PMC_d_gas_pollutant_hour_data |

| dbo.PMC_d_water_emition_day_data |

| dbo.PMC_d_water_emition_hour_data |

| dbo.PMC_d_water_pollutant_day_data |

| dbo.PMC_d_water_pollutant_hour_data |

| dbo.PMC_s_pollutant_code |

| dbo.Supervise |

| dbo.SysApp |

| dbo.SysAppClass |

| dbo.SysFolder |

| dbo.SysFolderApp |

| dbo.SysUser |

| dbo.SysWallpaper |

| dbo.Sys_MiDic |

| dbo.Sys_MiDic11 |

| dbo.Sys_StDic |

| dbo.Sys_StDic_Child |

| dbo.TEMP_B_CONTROL_DEVICE |

| dbo.TEMP_B_GAS_EMITION |

| dbo.TEMP_B_GAS_EMITION_POLLUTANT |

| dbo.TEMP_B_POLLUTION_INFO |

| dbo.TEMP_B_WATER_EMITION |

| dbo.TEMP_B_WATER_EMITION_POLLUTANT |

| dbo.TEMP_CORP |

| dbo.TEMP_CORP_New |

| dbo.TEMP_facotr_code |

| dbo.T_UPDATEID |

| dbo.T_VEHICLES |

| dbo.T_WRY_FQPFK |

| dbo.T_WRY_FQPFK2 |

| dbo.T_WRY_FQPFKYZ |

| dbo.T_WRY_FQPFKYZ2 |

| dbo.T_WRY_FQZLSS |

| dbo.T_WRY_FSPFK |

| dbo.T_WRY_FSPFK2 |

| dbo.T_WRY_FSPFKPFYZ |

| dbo.T_WRY_FSPFKPFYZ2 |

| dbo.T_WRY_FSZLSS |

| dbo.T_WRY_JBXX |

| dbo.T_WRY_JBXX1 |

| dbo.T_WRY_JBXX3 |

| dbo.T_WRY_JCBG |

| dbo.T_WRY_JCBG2 |

| dbo.T_WRY_JCFA |

| dbo.T_WRY_JCFA2 |

| dbo.T_WRY_JDXJC |

| dbo.T_WRY_JXXPF |

| dbo.T_WRY_SBTY |

| dbo.T_WRY_SBTY2 |

| dbo.T_WRY_SCSB |

| dbo.T_WRY_USER |

| dbo.T_WRY_USER2 |

| dbo.T_WRY_WJCYY |

| dbo.T_WRY_WJCYY2 |

| dbo.T_WRY_XTGG |

| dbo.T_WRY_ZCBG |

| dbo.Temp_XFMD |

| dbo.Temp_XXX |

| dbo.Temp_xxx1 |

| dbo.View_1bjbtj |

| dbo.View_2BJBTJ |

| dbo.View_Gas |

| dbo.View_QYZD |

| dbo.View_QYZD_Sync |

| dbo.View_SJ |

| dbo.View_Water |

| dbo.View_ZDYZ |

| dbo.View_ZS |

| dbo.View_emition_hour_data |

| dbo.View_zd_pollutant_hour_data |

| dbo.WRY_WKZJDXJCYY |

| dbo.d_water_pollutant_hour_data |

| dbo.sqlmapoutput |

+-------------------------------------+

漏洞证明:

QQ截图20160522151052.jpg





QQ截图20160522151100.jpg





QQ截图20160522162737.jpg





QQ截图20160522162745.jpg





QQ截图20160522162756.jpg



修复方案:


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
安徽省 环境保护 S QL
#1楼
发帖时间:2016-7-9   |   查看数:0   |   回复数:0
游客组