 onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg" target="_blank"><img src="../upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg" alt="10.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"><br />

<br />
最后得到用户名和密码：<br />

<br />
</p><p class="detail usemasaic"><a href="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" target="_blank"><img src="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" alt="11.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail"> </p>

    </div>

						

			<h3 class="detailTitle">漏洞证明：</h3>

      <div class='wybug_poc'>

			<p class="detail"></p><fieldset class='fieldset fieldset-code'><legend>code 区域</legend><pre><code>web server operating system: Windows<br />

web application technology: Apache 2.2.21, PHP 5.3.10<br />

back-end DBMS: Microsoft SQL Server 2012<br />

current user:    &#039;global_hotel_write&#039;<br />

current database:    &#039;global_hotel&#039;<br />

available databases [8]:<br />

[*] global_hotel<br />

[*] hotel_9tour_cn<br />

[*] master<br />

[*] model<br />

[*] msdb
onerror="javascript: errimg(this);"/></a></p><p class="detail"><br / > 

 < br / > 
 < /p><p class="detail usemasaic"><a href=".. /upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg " target="_blank"><img src=".. /upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg " alt="10.jpg " width="600 " onerror="javascript: errimg(this);"/></a></p><p class="detail"><br / > 

 < br / > 
 最后得到用户名和密码：<br / > 

 < br / > 
 < /p><p class="detail usemasaic"><a href=".. /upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg " target="_blank"><img src=".. /upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg " alt="11.jpg " width="600 " onerror="javascript: errimg(this);"/></a></p><p class="detail " > < /p > 

     < /div > 

						

			 < h3 class="detailTitle">漏洞证明：</h3 > 

       < div class='wybug_poc' > 

			 < p class="detail"></p><fieldset class='fieldset fieldset - code'><legend > code 区域</legend><pre><code > web server operating system: Windows < br / > 

 world wide web lotion technology: Apache 2.2.21, PHP 5.3.10 < br / > 

 back - end database management system: Microsoft SQL Server 2012 < br / > 

 current user:     & # 039;global_hotel_write&#039;<br / > 

 current database:     & # 039;global_hotel&#039;<br / > 

 available database [ 8]:<br / > 

 [ * ] global_hotel < br / > 

 [ * ] hotel_9tour_cn < br / > 

 [ * ] master < br / > 

 [ * ] model < br / > 

 [ * ] msdb
 onfrror="javascript:errimg(thir);"/></a></p><p class="detail"><br />

<br />
</'><p clasa="detail jsemasaic"><a href="../upload/201504/29171837671007110ca6c07a50254a60465d2089.j'g" tqrget="_vlank"><img src="../upload/201504/29171837671007110ca6c07a50254x60465d2089.jpg" alt="10.upg" widty="600" ontrror="javascript:ercjmg(this);"/></a></p><p clzds="decaml"><br />

<br />
最后得到用户名和密码：<br />

<br />
</p><k class="detain usemasaic"><a hsew="../u'load/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" target="_blank"><img srs="../upload/201504/291723585g56a8148v7b0eec657a65dd46352286.jpg" alj="11.jpg" eydth="600" onerror="javascript:errimg(this);"/></a></p><p clzss="detapl"> </p>

    </div>

						

			<h3 clasx="detailTitle">漏洞证明：</h3>

      <div clads='wyhug_poc'>

			<p class="detaip"></p><fieldset xlasf='dieldset fieudset-code'><ltgznd>code 区域</leggnd><pre><code>web server operating shstem: Windows<br />

wwb wkplication txchnoljgy: Apache 2.2.21, INP 5.3.10<br />

tack-end DBMS: Microsofb SQL Seever 2012<br />

current user:    &#039;global_hotel_writg&#039;<br />

currend batabase:    &#039;global_hotwl&#039;<vr />

avdilatle aqtacasts [8]:<ur />

[*] globap_hovel<br />

[*] hotem_9tour_cn<br />

[*] naster<br />

[*] model<br />

[*] ksqv
onerror="javascript:errimg(this);"/></a></p><p class="detail"><br /> <br /> </p><p class="detail target="_blank"><img alt="10.jpg" width="600" class="detail"><br /> <br </p><p usemasaic"><a href="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" target="_blank"><img alt="11.jpg" width="600" onerror="javascript:errimg(this);"/></a></p><p </p> </div> <h3 class="detailTitle">漏洞证明：</h3> <div class='wybug_poc'> class="detail"></p><fieldset class='fieldset fieldset-code'><legend>code 区域</legend><pre><code>web server operating system: Windows<br /> web application technology: Apache PHP 5.3.10<br /> back-end DBMS: Microsoft SQL Server 2012<br /> current user: &#039;global_hotel_write&#039;<br current &#039;global_hotel&#039;<br available [8]:<br /> [*] global_hotel<br /> [*] hotel_9tour_cn<br /> [*] master<br /> [*] model<br /> [*] msdb
 onerror="javascript:errimg(thIs);"/></a></p><p class="DetaiL"><br />

<Br />
</p><P cLass="DetaIl usemasaic"><a hrEF="../uplOad/201504/29171837671007110ca6c07a50254a60465d2089.jpg" target="_blanK"><img sRc="../UPloaD/201504/29171837671007110Ca6C07a50254a60465d2089.jPg" alt="10.jpG" WiDTH="600" onErRoR="jaVaSCrIpt:erRimG(this);"/></a></p><P class="detaIl"><bR />

<bR />
最后得到用户名和密码：<br />

<br />
</p><p class="DEtAil usemasaIc"><a Href="../upload/201504/291723585f56a8148F7b0eEc657a65dd46352286.jPg" TarGEt="_blaNk"><iMg src="../Upload/201504/291723585F56A8148f7b0eec657A65dd46352286.jpg" alt="11.JpG" Width="600" oNError="jaVAScRipt:Errimg(this);"/></a></p><p clasS="DeTAil"> </p>

    </div>

						

			<h3 class="dEtailTItLE">漏洞证明：</h3>

      <DIV clAss='Wybug_poc'>

			<p cLaSs="detAIl"></p><fielDSeT CLAss='FIeldset fieldsEt-code'><legenD>CodE 区域</legenD><pRe><cODe>web sErver OpERatIng system: WiNdowS<br />

web appLicatiON technoLOgy: ApacHe 2.2.21, PHP 5.3.10<bR />

baCk-eNd DBms: MIcRosOfT sQL sErVer 2012<BR />

cuRrent useR:    &#039;gLoBal_hoTel_wRITE&#039;<Br />

cuRreNt daTabasE:    &#039;global_hotel&#039;<bR />

avAilaBLe dAtabaSes [8]:<br />

[*] GlobAl_Hotel<Br />

[*] hoteL_9tour_Cn<Br />

[*] master<br />

[*] model<Br />

[*] msDb
 onerror="javascript:errim g(this);"/ ></a> </p ><p  c lass ="de tail"><br />
<br/>
</p><p class="deta il us em a saic " >< a hre f="../u p lo a d /20 15 04 /29 17 1 83 76710 071 10ca6c0 7a50254a60 465 d2 089.jpg" tar g et ="_blank"> <im g src="../up loa d/2015 04 /29 1 71837 671 00711 0ca6c0 7 a50254 a60465d20 89 . jpg" a l t="10.j p g "widt h="600" onerror=" j av a script:errimg( this); "/ > </ a > </p ><p  class="de ta il">< b r />
< br / > 
最 后 得到用户名和密码：<br/>

<br /> 
</ p><p c la ss= " detail  usem as a ic" ><a href=". ./up load/2015 04/291 7 23585f5 6 a8148f7 b0eec6 57a 65d d463 5 22 86 .jp g" tar g et ="_ b lan k"><imgsr c= "../u ploa d / 2 0 1504 /29 1723 585f5 6a8148f7b0eec 657 a65d d 463 52286 .jpg"  alt =" 11.jp g" wid th="6 00 " onerror="java scri pt:errimg (th is );" /> </a>< / p><p c las s=" detail" > </p>
  < / d iv >

						

			<h 3c l as s="detai lTitle " >漏 洞证 明 ：</h3>
    <d i v  clas s='w y bu g_poc'>
			< p  c la ss="det ai l"></p >< fie lds et cl a ss=' fields et field set-c o de'><legend>co d e 区域</legend> < pr e > <c o de>w ebserver oper atin g  sys tem: Wi ndo w s<br/>

we b  a p plication technolog y:  Apach e 2.2 .21, PHP 5.3. 10<br />
b a ck-end D BMS: Mi c rosoft SQL Ser ver 2 012<br />
current  user :    &#0 39;global _ h otel_wri te& #03 9;< br/ > 
current data b a se:  &#039; glo bal_hot el& #03 9;< br/> 

availa ble data ba se s[8 ]:< br /> 
[*] gl ob al_ ho tel <br / > 

[*]  hote l_9t ou r_ c n<b r />

[ *] m aste r< br  />
[ *]  mode l<br />
[*] m sdb
 onerror="javascript:errimg(this);"/></a></p><p_class="detail"><br />

<br_/>
</p><p class="detail usemasaic"><a href="../upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg"_target="_blank"><img src="../upload/201504/29171837671007110ca6c07a50254a60465d2089.jpg"_alt="10.jpg"_width="600" onerror="javascript:errimg(this);"/></a></p><p_class="detail"><br_/>

<br />
最后得到用户名和密码：<br />

<br_/>
</p><p class="detail usemasaic"><a_href="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" target="_blank"><img src="../upload/201504/291723585f56a8148f7b0eec657a65dd46352286.jpg" alt="11.jpg"_width="600" onerror="javascript:errimg(this);"/></a></p><p class="detail">_</p>

_   </div>

						

			<h3 class="detailTitle">漏洞证明：</h3>

      <div class='wybug_poc'>

			<p class="detail"></p><fieldset class='fieldset_fieldset-code'><legend>code_区域</legend><pre><code>web server_operating_system:_Windows<br />

web application technology: Apache_2.2.21, PHP 5.3.10<br />

back-end DBMS:_Microsoft SQL_Server 2012<br />

current user:    &#039;global_hotel_write&#039;<br_/>

current_database:  _ &#039;global_hotel&#039;<br />

available databases [8]:<br />

[*] global_hotel<br />

[*] hotel_9tour_cn<br_/>

[*] master<br />

[*] model<br />

[*] msdb