### 简要描述：
RT
### 详细说明：
海天OA存在一处sql注入 海天OA官网：http://www.haitiansoft.com:8080/ 前人有提交过，就不写那么多案例了，下面就用5个案例来做安全测试！
SQL注入点：
```
/flow/BiaoDanDangAn.asp?BiaoDanID=
```
### 漏洞证明：
案例：
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/oa/flow/BiaoDanDangAn.asp?BiaoDanID=1
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/vos/flow/BiaoDanDangAn.asp?BiaoDanID=1
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
案例一：
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
[<img src="https://images.seebug.org/upload/201411/0609291976622ee6c2dbb1ab35d3042cf88c7520.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0609291976622ee6c2dbb1ab35d3042cf88c7520.jpg)
```
```
[<img src="https://images.seebug.org/upload/201411/06092927b289692923f981a66628524df6e8a5de.jpg" alt="02.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/06092927b289692923f981a66628524df6e8a5de.jpg)
```
```
案例二：
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/oa/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
[<img src="https://images.seebug.org/upload/201411/060931125c8b1f70179cef3aa54a58ea4aff41e7.jpg" alt="03.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/060931125c8b1f70179cef3aa54a58ea4aff41e7.jpg)
```
```
案例三：
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
[<img src="https://images.seebug.org/upload/201411/060933141a04d1fee43d4bdadec09331d5fcdb7b.jpg" alt="04.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/060933141a04d1fee43d4bdadec09331d5fcdb7b.jpg)
```
```
案例四：
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
[<img src="https://images.seebug.org/upload/201411/0609374123b3599deee9a3d5033b11c54c9c3a67.jpg" alt="05.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0609374123b3599deee9a3d5033b11c54c9c3a67.jpg)
```
```
案例五：
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/vos/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
[<img src="https://images.seebug.org/upload/201411/060938454f438e03e2a6d961762adb58ea3d639f.jpg" alt="06.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/060938454f438e03e2a6d961762adb58ea3d639f.jpg)
```
```
案例六:
```
<fieldset class="fieldset fieldset-mask">
<legend>mask 区域</legend>
<pre><mask>1.http://**.**.**
</mask></pre>
</fieldset>
/flow/BiaoDanDangAn.asp?BiaoDanID=1
```
[<img src="https://images.seebug.org/upload/201411/06094013945adb4cb1a11314df96513b22bed9d9.jpg" alt="07.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/06094013945adb4cb1a11314df96513b22bed9d9.jpg)
```
```
京公网安备 11010502034610号
暂无评论