海天OA系统通用SQL注入(SA权限)#6

### 简要描述： RT ### 详细说明： 海天OA存在一处sql注入 海天OA官网：http://www.haitiansoft.com:8080/ 前人也有提交过我就不写那么多案例了，下面就用5个案例来做安全测试！ SQL注入点： ``` /meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom= ``` ### 漏洞证明： 案例： ``` http://180.166.7.94/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 http://oa.tjfsu.edu.cn/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 http://www.fzsyxx.com/oa/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 http://vos.tjufe.edu.cn/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 http://www.shhjwl.com/vos/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 http://www.cnshuiyu.com/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` 案例一： ``` http://180.166.7.94/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` [<img src="https://images.seebug.org/upload/201409/24172450f0cb377c604534c30c1cc31980a204dd.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/24172450f0cb377c604534c30c1cc31980a204dd.jpg) ``` ``` [<img src="https://images.seebug.org/upload/201409/24172503133b1e63d69ebf9ee09dba5c982c7559.jpg" alt="02.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/24172503133b1e63d69ebf9ee09dba5c982c7559.jpg) ``` ``` 案例二： ``` http://oa.tjfsu.edu.cn/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` [<img src="https://images.seebug.org/upload/201409/2417252988095775d87a7a744de20751b7b9cc56.jpg" alt="03.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/2417252988095775d87a7a744de20751b7b9cc56.jpg) ``` ``` 案例三： ``` http://www.fzsyxx.com/oa/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` [<img src="https://images.seebug.org/upload/201409/241725499ceeff431ce1c162fd0af822006fe157.jpg" alt="04.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/241725499ceeff431ce1c162fd0af822006fe157.jpg) ``` ``` 案例四： ``` http://vos.tjufe.edu.cn/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` [<img src="https://images.seebug.org/upload/201409/241726104c1b5a8eca0cb87da5edc2df983803eb.jpg" alt="05.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/241726104c1b5a8eca0cb87da5edc2df983803eb.jpg) ``` ``` 案例五： ``` http://www.shhjwl.com/vos/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` [<img src="https://images.seebug.org/upload/201409/24172635a4c4d0c2d558fb9a24b5a7f19ae0d038.jpg" alt="06.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/24172635a4c4d0c2d558fb9a24b5a7f19ae0d038.jpg) ``` ``` 案例六： ``` http://www.cnshuiyu.com/meetingroom/MeetingRoom_UseInfo.asp?MeetingRoom=1 ``` [<img src="https://images.seebug.org/upload/201409/2417265768ae22020f9e75965d1a20947f9bd638.jpg" alt="07.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/2417265768ae22020f9e75965d1a20947f9bd638.jpg) ``` ```