OA does not limit SQL Injection somewhere

OA does not limit SQL Injection somewhere
OA has a lot of injections after unrestricted SQL injection and login, but it is quite rare to find an injection that does not need to be logged in. The injection file is located at: \ defaultroot \ boardroom \ iWebOfficeSign_ SQL \ DocumentEdit. jsp \ defaultroot \ boardroom \ iWebOfficeSign_oracle \ DocumentEdit. jsp, where RecordID has Injection

String mRecordID = request. getParameter ("RecordID"); String mTemplate = request. getParameter ("Template"); String mFileType = request. getParameter ("FileType"); String mEditType = request. getParameter ("EditType"); String mUserName = new String (request. getParameter ("UserName "). getBytes ("iso8859_1"), "GBK"); // zhuo add judge module type (Information Management, official document) String moduleType = request. getParameter ("moduleType") = null? "Default": request. getParameter ("moduleType"); String isSaveHtmlImage = request. getParameter ("saveHtmlImage") = null? "0": request. getParameter ("saveHtmlImage"); // do you want to generate the HTML image file String isSaveDocFile = request. getParameter ("saveDocFile") = null? "0": request. getParameter ("saveDocFile"); // whether to generate a DOC file // obtain the id if (mRecordID = null) {mRecordID = ""; // No. Blank} // obtain the mode if (mEditType = null) {mEditType = "1 "; // 0 display 1 Draft 2 correction 3 Review} // obtain type if (mFileType = null) {mFileType = ". doc "; // document named .doc} // obtain the username if (mUserName = null) {mUserName =" kingge technology ";} // obtain the template if (mTemplate = null) {mTemplate = ""; // no template by default} // Open Database DBstep. iDBManager2000 DbaObj = new DBstep. iDBManager2000 (); if (DbaObj. openConnection () {String mSql = "Select * From Document Where RecordID = '" + mRecordID + "'"; try {result = DbaObj. executeQuery (mSql); if (result. next () {mRecordID = result. getString ("RecordID"); mTemplate = result. getString ("Template"); mSubject = result. getString ("Subject"); mAuthor = result. getString ("Author"); mFileDate = result. getString ("FileDate"); mStatus = result. getString ("Status"); mFileType = result. getString ("FileType"); mHTMLPath = result. getString ("HTMLPath");} else {// obtain the unique value (mRecordID) java. util. date dt = new java. util. date (); long lg = dt. getTime (); Long ld = new Long (lg); // The initial value is mRecordID = ld. toString (); // The Document ID is saved. You can find all the documents that belong to this record. mTemplate = mTemplate; mSubject = "Enter the topic "; mAuthor = mUserName; mFileDate = DbaObj. getDateTime (); mStatus = "DERF"; mFileType = mFileType; mHTMLPath = "";} result. close ();} catch (SQLException e) {System. out. println (e. toString ();} DbaObj. closeConnection ();}

 

Poc http://www.qlyxjy.cn: 8080/defaultroot/boardroom/iWebOfficeSign_ SQL/DocumentEdit. jsp? Export & EditType = 1 & UserName = 1 & moduleType = 1 & saveHtmlImage = 1 & saveDocFile = 1