### 简要描述： RT ### 详细说明： 海天OA存在一处sql注入 海天OA官网：http://www.haitiansoft.com:8080/ 前人也有提交过我就不写那么多案例了，下面就用5个案例来做安全测试！ SQL注入点： ``` /ZhuanTi/FolderDetails.asp?OAID= ``` 案例： ``` http://180.166.7.94/ZhuanTi/FolderDetails.asp?OAID=25 http://oa.tjfsu.edu.cn/ZhuanTi/FolderDetails.asp?OAID=25 http://www.fzsyxx.com/oa/ZhuanTi/FolderDetails.asp?OAID=25 http://vos.tjufe.edu.cn/ZhuanTi/FolderDetails.asp?OAID=25 http://www.shhjwl.com/vos/ZhuanTi/FolderDetails.asp?OAID=25 ``` ### 漏洞证明： 案例一： ``` http://180.166.7.94/ZhuanTi/FolderDetails.asp?OAID=25 ``` [<img src="https://images.seebug.org/upload/201411/141613263a156bd5b78b56a1a9ad65afa0b9ab45.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/141613263a156bd5b78b56a1a9ad65afa0b9ab45.jpg) ``` ``` [<img src="https://images.seebug.org/upload/201411/141613361096ec61c461b544171032d0ec49bc84.jpg" alt="02.jpg" width="600"...
### 简要描述： RT ### 详细说明： 海天OA存在一处sql注入 海天OA官网：http://www.haitiansoft.com:8080/ 前人也有提交过我就不写那么多案例了，下面就用5个案例来做安全测试！ SQL注入点： ``` /ZhuanTi/FolderDetails.asp?OAID= ``` 案例： ``` http://180.166.7.94/ZhuanTi/FolderDetails.asp?OAID=25 http://oa.tjfsu.edu.cn/ZhuanTi/FolderDetails.asp?OAID=25 http://www.fzsyxx.com/oa/ZhuanTi/FolderDetails.asp?OAID=25 http://vos.tjufe.edu.cn/ZhuanTi/FolderDetails.asp?OAID=25 http://www.shhjwl.com/vos/ZhuanTi/FolderDetails.asp?OAID=25 ``` ### 漏洞证明： 案例一： ``` http://180.166.7.94/ZhuanTi/FolderDetails.asp?OAID=25 ``` [<img src="https://images.seebug.org/upload/201411/141613263a156bd5b78b56a1a9ad65afa0b9ab45.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/141613263a156bd5b78b56a1a9ad65afa0b9ab45.jpg) ``` ``` [<img src="https://images.seebug.org/upload/201411/141613361096ec61c461b544171032d0ec49bc84.jpg" alt="02.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/141613361096ec61c461b544171032d0ec49bc84.jpg) ``` ``` 案例二： ``` http://oa.tjfsu.edu.cn/ZhuanTi/FolderDetails.asp?OAID=25 ``` [<img src="https://images.seebug.org/upload/201411/1416135513ec72d242aef46680bb3d4190ddbaef.jpg" alt="03.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/1416135513ec72d242aef46680bb3d4190ddbaef.jpg) ``` ``` 案例三： ``` http://www.fzsyxx.com/oa/ZhuanTi/FolderDetails.asp?OAID=25 ``` [<img src="https://images.seebug.org/upload/201411/141614178b33e048ec9eed5be6d619e4c8dc747e.jpg" alt="04.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/141614178b33e048ec9eed5be6d619e4c8dc747e.jpg) ``` ``` 案例四： ``` http://vos.tjufe.edu.cn/ZhuanTi/FolderDetails.asp?OAID=25 ``` [<img src="https://images.seebug.org/upload/201411/141614324fc439697246d328adf1a6510d60308b.jpg" alt="05.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/141614324fc439697246d328adf1a6510d60308b.jpg) ``` ``` 案例五： ``` http://www.shhjwl.com/vos/ZhuanTi/FolderDetails.asp?OAID=25 ``` [<img src="https://images.seebug.org/upload/201411/1416145378d2212c59bb6a8175ff785e4bc0ef97.jpg" alt="06.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/1416145378d2212c59bb6a8175ff785e4bc0ef97.jpg) ``` ```
