### 简要描述：
rt
### 详细说明：
根据http://**.**.**.**/bugs/wooyun-2015-0136712进行测试发现的。
```
POST /login.php?Cmd=login HTTP/1.1
Host: **.**.**.**
Content-Length: 71
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20120101 Firefox/33.0
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/login.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=28283054d2c8717160a08a9a8f504ef8
name=admin&domain=**.**.**.**&passwd=admin&login=-login-&language=-&Lang=
```
参数name和domain度存在注入。(部分站点需使用tamper=space2comment绕过)
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201510/091639500f3b772f2a26a028a1455eedd3c390a0.jpg" alt="aaaaaaaaaaaaaaaa111111111111111111111111.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/091639500f3b772f2a26a028a1455eedd3c390a0.jpg)
[<img src="https://images.seebug.org/upload/201510/091640039b8474d8e8bf5d638c4b320626b55900.jpg" alt="aaaaaaaaaaaaaa222222222222222222222222.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/091640039b8474d8e8bf5d638c4b320626b55900.jpg)
[<img src="https://images.seebug.org/upload/201510/091640226cc461d6f200ae3424a259e9bad1f795.jpg" alt="aaaaaaaaaaaaaaa3333333333333333333.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/091640226cc461d6f200ae3424a259e9bad1f795.jpg)
[<img src="https://images.seebug.org/upload/201510/0916413752c857ff8252bf5dcfe4dfdc124a075a.jpg" alt="aaaaaaaaaaaaaaaa444444444444444444444444.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/0916413752c857ff8252bf5dcfe4dfdc124a075a.jpg)
[<img src="https://images.seebug.org/upload/201510/09164205d81b15f0c3b516198e3162bf0fc37023.jpg" alt="aaaaaaaaaaaaaaaa5555555555555555555555555.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/09164205d81b15f0c3b516198e3162bf0fc37023.jpg)
[<img src="https://images.seebug.org/upload/201510/091642292849ede1f066de506a5453dbcc3f9b20.jpg" alt="aaaaaaaaaaaaaaaa66666666666666666666666.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/091642292849ede1f066de506a5453dbcc3f9b20.jpg)
[<img src="https://images.seebug.org/upload/201510/09164400109190c149fb638f96356dc29f11a128.jpg" alt="aaaaaaaaaaaaaaaa77777777777777777777.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/09164400109190c149fb638f96356dc29f11a128.jpg)
案例：
京公网安备 11010502034610号
暂无评论