某OA系统存在SQL注入（sa权限）

### 简要描述： RT ### 详细说明： 前人也有提交过，我就拿几个案例来测试 海天OA官网：http://www.haitiansoft.com:8080/ 注入点： ``` /Documents/OA_DocDisplay_NewWindow.asp?OAID= ``` ### 漏洞证明： 案例： ``` http://180.166.7.94/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 http://124.65.69.14/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 http://vos.tjufe.edu.cn/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 http://oa.ccib.com.cn/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 http://www.cnshuiyu.com/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 http://116.228.82.237/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` 案例一： ``` http://180.166.7.94/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` [<img src="https://images.seebug.org/upload/201411/09175506dfb0e85fe83498053c2cfbc7d41dbe0c.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/09175506dfb0e85fe83498053c2cfbc7d41dbe0c.jpg) ``` ``` 案例二： ``` http://124.65.69.14/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` [<img src="https://images.seebug.org/upload/201411/09175526e92e2543f87be95c30d7944327898b13.jpg" alt="02.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/09175526e92e2543f87be95c30d7944327898b13.jpg) ``` ``` 案例三： ``` http://vos.tjufe.edu.cn/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` [<img src="https://images.seebug.org/upload/201411/091755449339983ffb12e89d54681b4deb9c9f46.jpg" alt="03.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/091755449339983ffb12e89d54681b4deb9c9f46.jpg) ``` ``` 案例四： ``` http://oa.ccib.com.cn/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` [<img src="https://images.seebug.org/upload/201411/09175603a3b99f7f6cba33af2ea0550ad908581a.jpg" alt="04.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/09175603a3b99f7f6cba33af2ea0550ad908581a.jpg) ``` ``` 案例五： ``` http://www.cnshuiyu.com/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` [<img src="https://images.seebug.org/upload/201411/09175621d637beed40c1df4384a2ef6e788fd801.jpg" alt="05.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/09175621d637beed40c1df4384a2ef6e788fd801.jpg) ``` ``` 案例六： ``` http://116.228.82.237/Documents/OA_DocDisplay_NewWindow.asp?OAID=1 ``` [<img src="https://images.seebug.org/upload/201411/091756408f08f99d1ab8b843893eac05022eb39c.jpg" alt="06.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/091756408f08f99d1ab8b843893eac05022eb39c.jpg) ``` ```