Website vulnerabilities no verification for specific sites vulnerabilities (weak passwords, SQL injection, and Arbitrary File Uploads)

Website vulnerabilities no verification for specific sites vulnerabilities (weak passwords, SQL injection, and Arbitrary File Uploads)

P2p financial security: website vulnerabilities in multiple locations (weak passwords, SQL injection, and Arbitrary File Uploads)

Unexpected discovery http://acc.rxdai.com: 8585/EmployeeQuery/Login. aspx did not validate such as a verification code. I thought of top1's weak password 12456 and ran it together. Find the relevant account from the previous post, and then run it with the Burp

302 indicates that the user does not exist or the login is successful. A jump with a high ID does not exist. A jump with a low ID indicates a successful login.

After logging on to the system, you can find that SQL Injection exists in the address of any query.

Captured packets and dropped them to sqlmap.

Any file can be uploaded at the file location. No filtering at all

It is found that the permission is relatively high, or the Intranet permission

You can continue to penetrate the Intranet.