Allow me to perform various simple tests on CRM permissions bypass, upload, XSS, and SQL Injection

Various simple tests such as Permission Bypass, upload, XSS, and SQL Injection for any of our CRM systems

A company's internal network used this system. The first time I saw it, I couldn't help looking at WEB applications ~~

1. Upload
Signature format:

Find the address:

Get shell:

2. XSS
In many places, the mail title is intercepted here:

3. Permission Bypass

There may be friends who don't have employee accounts that cannot go into the system! Not enough! This program has the permission to bypass ~~ Direct Access: http: // 192.168.0.88/crm/Message/ExMailSend. asp? UID = & AccountID = & MailID = 1 & IsPrivate = 1 & OperateType = ReSend & TimeID = 0.13946238309452646 enter the email writing interface, you can upload, XSS, of course, Permission Bypass will happen soon here, and many pages have the permission to bypass:

 

4. SQL Injection

This will not be explained much ~~ I have read some source code through webshell and won't post it for a long time. Some parameters are checked for type, but some are not filtered: