### 简要描述： 唉，据说都不关注它了？ ### 详细说明： 以官网系统为例 首先我们看看登陆的时候的返回值 http://**.**.**.**/login.do?message=102&verify= [<img src="https://images.seebug.org/upload/201508/251406534fb0314e72446772ac5d1a2f8a3d4262.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251406534fb0314e72446772ac5d1a2f8a3d4262.png) http://**.**.**.**/login.do?message=103&verify= [<img src="https://images.seebug.org/upload/201508/251407298741887fafd2c7860f3b272cda5f93f6.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251407298741887fafd2c7860f3b272cda5f93f6.png) 那么现在我们可以抓包开始注入了 [<img src="https://images.seebug.org/upload/201508/25140748fdd6c7dfa15f6f71007d7b13c0dbd5fd.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140748fdd6c7dfa15f6f71007d7b13c0dbd5fd.png) [<img src="https://images.seebug.org/upload/201508/2514080868c5fdf57d271553f2a2add2b58a64f4.jpg"...
### 简要描述： 唉，据说都不关注它了？ ### 详细说明： 以官网系统为例 首先我们看看登陆的时候的返回值 http://**.**.**.**/login.do?message=102&verify= [<img src="https://images.seebug.org/upload/201508/251406534fb0314e72446772ac5d1a2f8a3d4262.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251406534fb0314e72446772ac5d1a2f8a3d4262.png) http://**.**.**.**/login.do?message=103&verify= [<img src="https://images.seebug.org/upload/201508/251407298741887fafd2c7860f3b272cda5f93f6.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251407298741887fafd2c7860f3b272cda5f93f6.png) 那么现在我们可以抓包开始注入了 [<img src="https://images.seebug.org/upload/201508/25140748fdd6c7dfa15f6f71007d7b13c0dbd5fd.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140748fdd6c7dfa15f6f71007d7b13c0dbd5fd.png) [<img src="https://images.seebug.org/upload/201508/2514080868c5fdf57d271553f2a2add2b58a64f4.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2514080868c5fdf57d271553f2a2add2b58a64f4.jpg) 构造好万能登陆句子，成功登陆后台。。 MD5密码解出来为1 [<img src="https://images.seebug.org/upload/201508/251408519374f80cad29bf6f64db873598ae86e0.png" alt="QE}BU{PW31{E{09]8STCWJH.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251408519374f80cad29bf6f64db873598ae86e0.png) [<img src="https://images.seebug.org/upload/201508/251409007b51c48276b9dbb05617f7ffe0aae34a.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251409007b51c48276b9dbb05617f7ffe0aae34a.png) 这是用万能密码登陆后的账户，下面这个是官方跳转后的账户。。 [<img src="https://images.seebug.org/upload/201508/25140919e6c6c1f1ee1c22fd209b1b302448ad0f.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140919e6c6c1f1ee1c22fd209b1b302448ad0f.png) 登陆后，再看看注入,点击新闻： [<img src="https://images.seebug.org/upload/201508/25140938420005c5cd347faaefe7203febc78943.png" alt="7.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140938420005c5cd347faaefe7203febc78943.png) 这里也存在注入，SA权限，由于是官方的例子，演示多了也没啥意思，来几张图片： [<img src="https://images.seebug.org/upload/201508/251410420272c5c251f802c4cbfc033a11ab294d.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251410420272c5c251f802c4cbfc033a11ab294d.jpg) 下面以中国移动为例:http://**.**.**.**:89/login.do [<img src="https://images.seebug.org/upload/201508/2514111877354315e0c246a38635d49573ed6a4c.png" alt="9.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2514111877354315e0c246a38635d49573ed6a4c.png) 同样的漏洞问题，利用万能密码登陆 [<img src="https://images.seebug.org/upload/201508/25141140adecc68cbe093fddafed45c20dbe2522.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141140adecc68cbe093fddafed45c20dbe2522.png) 密码解出来同样是1 [<img src="https://images.seebug.org/upload/201508/2514120599a6e2e76e392c446acb515d17e05097.png" alt="11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2514120599a6e2e76e392c446acb515d17e05097.png) 此处同样存在注入，接下来看图。。。 [<img src="https://images.seebug.org/upload/201508/25141224400d441e7221e491c41f540ebd420201.png" alt="13.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141224400d441e7221e491c41f540ebd420201.png) [<img src="https://images.seebug.org/upload/201508/251412517f17c4d3c97914c9fcb4bca874e84cce.png" alt="14.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251412517f17c4d3c97914c9fcb4bca874e84cce.png) [<img src="https://images.seebug.org/upload/201508/251413261fbd0b66b063f3beb8e14789024f4ecd.jpg" alt="15.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251413261fbd0b66b063f3beb8e14789024f4ecd.jpg) 看看移动有多少表： [<img src="https://images.seebug.org/upload/201508/25141409ccb2b3adb6b461c61ed6db69296583cd.png" alt="17.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141409ccb2b3adb6b461c61ed6db69296583cd.png) 1961张表，数据还是蛮大的，表太多就不跑了， OK 到此为止吧，看看有多少厂家用了这个办公平台 [<img src="https://images.seebug.org/upload/201508/251413509687a14314657ccc6b0f860ff19f3cd3.png" alt="16.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251413509687a14314657ccc6b0f860ff19f3cd3.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201508/25141421d042a9f1364222c5c70196eb368d94e4.png" alt="17.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141421d042a9f1364222c5c70196eb368d94e4.png) [<img src="https://images.seebug.org/upload/201508/25141432fd7da11c2cd7ca2347d7fb382bc43719.jpg" alt="15.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141432fd7da11c2cd7ca2347d7fb382bc43719.jpg) [<img src="https://images.seebug.org/upload/201508/25141444fbcd0e4c70c3533eae629c19e96e05db.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141444fbcd0e4c70c3533eae629c19e96e05db.png)
