美的電器,美的生活,美的享受

詳細(xì)說(shuō)明：

    http://rdetoway.midea.com.cn/web/rdlogin.jsp 存在POST注入

    抓包

POST /web/SubmitLogin.do HTTP/1.1Host: rdetoway.midea.com.cnUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.3.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://rdetoway.midea.com.cn/web/rdlogin.jspCookie: CPCUserName=11; ch1=true; ch2=false; entcode=mdrd; lastloginuser=11; JSESSIONID=agli4RIEd83__xO14cConnection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 122value%28entcode1%29=mdrd&value%28entcode%29=mdrd&value%28userName%29=11&value%28password%29=111&Submit=%E7%99%BB+%E5%BD%95

    POST注入

漏洞證明：

    13397個(gè)

    隨便找了一個(gè)庫(kù)

    修復(fù)方案：

    過(guò)濾!