### 简要描述：
唉，据说都不关注它了？
### 详细说明：
以官网系统为例
首先我们看看登陆的时候的返回值
http://**.**.**.**/login.do?message=102&verify=
[<img src="https://images.seebug.org/upload/201508/251406534fb0314e72446772ac5d1a2f8a3d4262.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251406534fb0314e72446772ac5d1a2f8a3d4262.png)
http://**.**.**.**/login.do?message=103&verify=
[<img src="https://images.seebug.org/upload/201508/251407298741887fafd2c7860f3b272cda5f93f6.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251407298741887fafd2c7860f3b272cda5f93f6.png)
那么现在我们可以抓包开始注入了
[<img src="https://images.seebug.org/upload/201508/25140748fdd6c7dfa15f6f71007d7b13c0dbd5fd.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140748fdd6c7dfa15f6f71007d7b13c0dbd5fd.png)
[<img src="https://images.seebug.org/upload/201508/2514080868c5fdf57d271553f2a2add2b58a64f4.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2514080868c5fdf57d271553f2a2add2b58a64f4.jpg)
构造好万能登陆句子，成功登陆后台。。
MD5密码解出来为1
[<img src="https://images.seebug.org/upload/201508/251408519374f80cad29bf6f64db873598ae86e0.png" alt="QE}BU{PW31{E{09]8STCWJH.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251408519374f80cad29bf6f64db873598ae86e0.png)
[<img src="https://images.seebug.org/upload/201508/251409007b51c48276b9dbb05617f7ffe0aae34a.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251409007b51c48276b9dbb05617f7ffe0aae34a.png)
这是用万能密码登陆后的账户，下面这个是官方跳转后的账户。。
[<img src="https://images.seebug.org/upload/201508/25140919e6c6c1f1ee1c22fd209b1b302448ad0f.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140919e6c6c1f1ee1c22fd209b1b302448ad0f.png)
登陆后，再看看注入,点击新闻：
[<img src="https://images.seebug.org/upload/201508/25140938420005c5cd347faaefe7203febc78943.png" alt="7.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25140938420005c5cd347faaefe7203febc78943.png)
这里也存在注入，SA权限，由于是官方的例子，演示多了也没啥意思，来几张图片：
[<img src="https://images.seebug.org/upload/201508/251410420272c5c251f802c4cbfc033a11ab294d.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251410420272c5c251f802c4cbfc033a11ab294d.jpg)
下面以中国移动为例:http://**.**.**.**:89/login.do
[<img src="https://images.seebug.org/upload/201508/2514111877354315e0c246a38635d49573ed6a4c.png" alt="9.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2514111877354315e0c246a38635d49573ed6a4c.png)
同样的漏洞问题，利用万能密码登陆
[<img src="https://images.seebug.org/upload/201508/25141140adecc68cbe093fddafed45c20dbe2522.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141140adecc68cbe093fddafed45c20dbe2522.png)
密码解出来同样是1
[<img src="https://images.seebug.org/upload/201508/2514120599a6e2e76e392c446acb515d17e05097.png" alt="11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/2514120599a6e2e76e392c446acb515d17e05097.png)
此处同样存在注入，接下来看图。。。
[<img src="https://images.seebug.org/upload/201508/25141224400d441e7221e491c41f540ebd420201.png" alt="13.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141224400d441e7221e491c41f540ebd420201.png)
[<img src="https://images.seebug.org/upload/201508/251412517f17c4d3c97914c9fcb4bca874e84cce.png" alt="14.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251412517f17c4d3c97914c9fcb4bca874e84cce.png)
[<img src="https://images.seebug.org/upload/201508/251413261fbd0b66b063f3beb8e14789024f4ecd.jpg" alt="15.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251413261fbd0b66b063f3beb8e14789024f4ecd.jpg)
看看移动有多少表：
[<img src="https://images.seebug.org/upload/201508/25141409ccb2b3adb6b461c61ed6db69296583cd.png" alt="17.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141409ccb2b3adb6b461c61ed6db69296583cd.png)
1961张表，数据还是蛮大的，表太多就不跑了，
OK 到此为止吧，看看有多少厂家用了这个办公平台
[<img src="https://images.seebug.org/upload/201508/251413509687a14314657ccc6b0f860ff19f3cd3.png" alt="16.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/251413509687a14314657ccc6b0f860ff19f3cd3.png)
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201508/25141421d042a9f1364222c5c70196eb368d94e4.png" alt="17.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141421d042a9f1364222c5c70196eb368d94e4.png)
[<img src="https://images.seebug.org/upload/201508/25141432fd7da11c2cd7ca2347d7fb382bc43719.jpg" alt="15.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141432fd7da11c2cd7ca2347d7fb382bc43719.jpg)
[<img src="https://images.seebug.org/upload/201508/25141444fbcd0e4c70c3533eae629c19e96e05db.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/25141444fbcd0e4c70c3533eae629c19e96e05db.png)
京ICP备10040895号
暂无评论