mirror of
https://github.com/adysec/POC.git
synced 2025-11-05 02:13:47 +00:00
19 lines
716 B
Markdown
19 lines
716 B
Markdown
# 微信公众号商家收银台小程序系统存在前台SQL注入漏洞
|
||
|
||
微信公众号商家收银台小程序系统存在前台SQL注入漏洞，/system/platform/controller/index.php 登录控制器中的api_login_check 方法，通过POST传入username,password,code 三个参数之后直接进入到SQL查询中，且未有任何过滤，导致漏洞产生。
|
||
|
||
## fofa
|
||
|
||
```javascript
|
||
"/index.php?s=platform/index/captcha"
|
||
```
|
||
|
||
## poc
|
||
|
||
```javascript
|
||
1' OR 1=1 OR '1'='1
|
||
```
|
||
|
||
|
||
|
||
 |