安全研究
CVE-2023-7137 Client Details System 1.0 SQL 注入：uemail 参数的经典 boolean-based 漏洞
Thinking
2024-07-04
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Client Details System 1.0 登录端点把 uemail 参数直接拼到 SQL 查询，攻击者用经典 OR 1=1 绕过登录，再丢给 SQLmap 一键导出整个数据库。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247682ce892d78cabe692479d0a10f10679507048881395c95f8d26ef6c6abc50c7b23cb62a30c73b6d125294e1d31911281af1ae010f7fa113dc539cb5d42db5be3deb1808bb778006758649a3309aac9d5908883fa1bca619eb80dd1cbe3e99c27c6167728d445d6bbede2fa97fd64c1feed0de1b1e2f576c1d110058c0c08a9e0bb5a401bf27d2a1d957d915150101961bc52433b10187fe2946fac503b9b77fbb41c4f0bd04604ed2d858f84d5a8cbbb41614f2732e3206b0ff8c5185a5395f8b61a9267098302f2876a5a8e442a4ff129b238e08d9c1a37bb18f2a76c5f56aee46847ce3c17ab5feb08d645972c63aedc57af4f38f0b2b2c8e4fcf8a38be098f343425d5dc2422aebce47198117c8ea2b752faad1a81895a68ce060422710b7ac7f598d958617c92d1bf1b79206570172cd9938d3e9ad2162acf048c7244214a2d7c73a1303e1fdbc9930550073216c9ccde6425ea67089effc507441646073acc8e6e756876be35174c4c85d0b882464d0493e7a546dafdb12237afdb6809630d789d0fdc6cf4dcf72db0a64199d4ce1ab306834b3e997b2ec8b58696ac766049784f329da0bcfeb1985028cbdd844dbd3356b7e05ca81b8fb9c5159638b4cba07dda052da91578e0ce65c44071046893e213cb9e7ade43daeaeec2fc3a90bfeb260dcd5dc7fdefa5c40b8a9003fade7a395ca93abc7e7c7445463ad493cb3bb75a3be0da4dce6baaa0096863601d41699400b2726b39ff7959907af9e45092b6f02ae8280e017ffd9ce1d7fa91e18e86df8c73597386b6eb1050d7f1c00b1c1303d17adc0eef2093efabc124da7a7f7fad2424fe2c2e5729bd2052da2e5fc0070a0a8e88449b627dd9abeeafc10e730b84b6db33a4ad5388418c9d7ca8e51107c0969a55cb4968a6c8b999e48ea9d067a173c863b016177abc4960c092a565cc912052e410a7a53fb95e59949670111936a3584d7db59c7967479c6851ce51e3218a10ec62c7efd296421a15e508f36ef85f3a7fcbc570ecab3d6752eefeb0a34df94981f2936c35b506093e4a2ba6a743ef269cb7293efd79b50f3edb38389c0650903daf45441ed96ca1feecc7215fff77961a2e814ccca2134ab933f1433fa1f481191c827284544f6860f0220126a680bf30f798002f4cdbf2d75796a8bf67778b490d2b8f78b3d3f75360006c60e839b6366bab98002f0d030e275ca43399073d1e49ce5fd47daad347551dd085c801c1a98365a2ded579d6ea5cf93c8edda522dfdd92fa5618ac2a3e4ee1c193798b8f656a94cd2c529e01d9092939ac1f62c0f14c97d98e5d127665e71e4a485197606b82033a717c11fd53344b1002f1727bdc85628e19d6de68dceb485b28f23e52d51bb5ddacbad7357b9fb1629482d637adcdb9f7674840412f7ef6544b1f9a21ea97efa216db870d4f410d5d4b57de44570bd1763f7d66b3cdd6339493744e098674ed120db5e3aa4c26f17edb918f823eeddb9a02ed69baf361a1c3635d39f25355f22f4ba81fde68e5a8d5fce6678dd686942e392ab29cc94a33edf8a2ab4eb42b538f8b40dd01806b8ce42054bdd044e2b81e75f33be331841367aa23fa7ab1936cbe067b75e107493bb7e8fa97c2e91d853cd51789ed859a0d26bf43192d784615cdabb99ece2c7fe6cc3aa6ee4a468c665c167d09ab314714f10a3e3d8c9b25a97c194734d92143c89a5640f1520573815470c54f911520efa9f35166b95ea3d0e724dc9515ef9c86bd343c58a0b8d127dea3ef19288bc502707d57a99dab7f8331964cbb75d4c2bfe0f6558383db4feae527e302020c21e9a7d00a70decfd17145716ec7381d4845d83923028cd99db942a5bf107d8d39adca6fd0e4c8825cc85624dad9e8031f70f1267e0136e48d70ee5318b053e6adf7223aecf8d6b953246d8de9e2c315a6e62c8399867c54b14cdde4b3a894f3af66488f5d17c7f4d78f9046c5e492837c7e6da770f48735624046f83d50847780ddedc59c47fbbae82b262dff76201daed40aa8ecb8370a1ca9eb9d2e1f8e5615340c41e0594a927235ec2a6fc699accf82bd75fcb6337a376b38fc80276ec9b05098c43522d3a9b30337b319025c3e41ace6c1aa9382925a75958c2c0e4cb5c6cc8a48eefe3ac8712bb3a0022553e35985bd93f4f6e4f5d950053fb00b2a06548cf87b03257ba27e9aadc4565ca9337634421ae896d7cb06efa5188b1f2dff1e04b49eff00b65f20b7ac5762b3e4a7451ae54fb3d876c9953dd63550932af338fe23d32322d4383d52d7480a3f77a95c7a31b6ffcb3c8e3381b60e643e0d391c10afab6ff059f60c984a6b0270b3ff8c266591b6843d7ae80afde6bc9c762d73e839b9906c634b777010f987aa1977d2547decac276fc5f1634b1b379f650ed324b8270006a4eb61bc5232146bb9ff40beb4e0d3fee50245078f7b30d6a9b3e3d932f176ad4a78fa7db32509705d64da844beb2cf47ed0b886c4a394ee401357721e263008ab5345870ad9d2b2671f5fdf289cf98db65f358d89424f1aef77a2568e8d4b8e55dcb9d4c4b91a362b1b97b76b19c70875f4fe081937576af9b99edfdeb18c9653c09755e38ac847abf148366b3494cf137cab27dcc849995a4240e828e0b6195ed587d7427cd26303574fab3547c72a2b881b7912509d75edfd65aaa09ba19ff4e506e5b9f7bb0b96452d560189da835126e98726021d8322097d1adf85898c4099655e04447e1c29a08673f75550fcfd51ca984db7ae861bb4f2708762439b2f6c47797a723e06c7a802aa95dd35f9b0e7153c86d3bd9345a7da51bb4e4f643984fc0f60de194663705e328b944e03bfe6a90fd1b98ce2e38d443166ff0c4f76ccdf748948f4000a36946e85849f0cefd0d4b23f2b5fb6af61035dea15414cc9be9eed0cf4226725d9897f9c63285f04bdd03a76ecb8b7f9c6244d8f229542858e8c6c684b7c0a8ad9be82176669a3c25da484c830cc90bd969e13326b87a5d685394b2b0c68162adae9b2a4d4bfac34b5dc64d98734370df72d824e5894932a7f00b171ca8885a9a508ca49c3dad8ab7f0f90c5a37db71decee62300e847fe5d396a7ebb953f851bf0c4b2d15b04c6fc692a2f3cc54f5d43dfc70257c2c422824e6e2c9ec8ceb0016c141fb94b741e955a4490a9e9320b807fbd3251b5720e315dee33a47543215d94f9212d9a6be7becb11bdb1541e628c5ff47fad43656ade7bf92426507901cbc90001025bdbaff5dd47c1053de7f05c5fe69690d4aa6cdcffaeb99ef5f7daa1d909dec77234d1c83c42254e771a2a64fa93a99cfabf5575259fa5f05bed363336d50aebb1bb4c888a8dd8847d185a0727bc0fe9212631a96a1e16f53ea7873279d2fc284530bdfe21ec21393744b00196a91bdb25b676b86ea7d636b6870b5f1824ac89d34ef3084d31e9ef778c8384743b476ad8dd8a3dd74ea6f745781086726d2871fcca046a05c9c7a1cb3c784c4db4dfae84001e0e127d04ff184fee8f88130dae2a81c441bdddd3413bbce9bf48888d215ddfc6501a741e78c1d55fcb428a5b86a8bf57734ed094716ebd98fbc54b3b10ad89e2f910636759b87d1b353e50a141dc0d88e295ec53450cf6390affeec6b55bd3db9edfd779c4d3c69b8b9193fb2b8251fbba995c7e1c95ae889ad66fa0a3b7aae66c9e789de0842893b07e19f828c82b45e3fc35d922f89c9ee9c7aef43f755de5d85f8af0ca7ae4e37409fe9f603dcaa78a7bbb4bed98dd72f870e117ee546e890d2ba268496c253200fe0edf15be6f1e02f06dca8c8b8e9be974609468a25c76d9be408b1ddedb485753ffe13f3f7f0ec755fbb5f313afaab2c08156f914225cdb405c6a8e934e82a22840ab7eb348ddfaa1c1278cad83e95e18cfacb4530d29c70d00292f574234c5a8d4442223e50fcb44715601ff7dcad8d47e558e686ff71329830f7480adc8c2469da38aa84951ac1a562adeeb0f816f449b0e5eb07ccf1ae56670e9a59bf149245626dde1d15a0457093cce616aa3081a4ff711c0b2bebe163a7d793b418ac8963e84a8af305dc41837178a165a0c9847dfdc00527d141646713a6dee6676145fbe49f0034ec86637bcf0c1e73c6bce96e1ec6383a77495065dc75df8321312ef5157835de5022007d856ecbb1dd9f315956f2b0f7d054259546f46fb9ae510cac3a28080f758c295920a85d5ed181f3ade9eae305d93c67be36ab561be9440109d58d3fc21ef94919cc5b88050cd1011f5f749ca13ebd5dd88432adad233031771c0e70543f57ed12084f2c822b611a60c0b0d4cbdfb431249bdff525f582a8ae13c286c85142f7c211c67d9a66e75c8184fdf9b49021e995e01af4ca19480849a8e87bf9e9d79c6bf39d354265a7ca29ae2f8c2cc57584aa1ab29763aba40fe70aa517cd5f6f86ceb85cd80beeeb1ac0c676a341d4198e7713980b3f0ace19bcd7fa9c3105cc452781b346b62621c17c9ff017a5aa7fd4e3f2415f754fde1ce17da1d783ae1761c9fc8abc61d591409af705eee4d82eb9b7a70bcd1a7f87ff83b4cade51e6409da3bc201a224d5fc039adfe13ca555cceebae160caabf5da5a698ec566485d400d1ddebc0c48b09139c577d8b345a536c8375aba4b323bca1e2d450fd7ed1ce88eb7ebbfc9180648e4288ff4c9cd3b207ab6ab2548c14bdeaea57e56dd92d761c0be0d2cdaae6386b093e4834f0f535d26f5e61aff8e85706b85061226163183bc957fc4f70bab135a3ec3fa57aa8148be3fd10f1f704db397dccaf203c8308e5244963ebab61d481956c58b237654b25d300fbaa8a64396564b6d1893f0fbf0bf7c03eaa6bb4b391e003c8c853206d8a8b553561e104fa3f315a2693212c378f303dcc5249e73c825a746ab7ab8e3bdd4fc6f43b7dc01fd1802d7957ea71906f9bc2f815791fee39f05c8ad5b9a71a65406daeeef04c71abf1c188fc73025032cd504cc36621234d180120aace9aee10d6bb01789a11e9802aca328af49be7ccda2de6e4eb95d1492bc4ae064beab92fddd1f5c99a66aa3fd0c44d93d99ffce2873e7886b6330dad35fe5ca55370b063c17227a333e4cecc98192e133a7fd0d13b44c5e6966a1dbc81db096ec7406fab93d31e8584f42b51fd0fd4c4963b69781f1d3bd98b91b9dab5ac1f25528a7074d640b899973f4676fb935e33fae0c88e04fc5f6c70afe61c4a0dcf1d5ba58878df692b57271ecae72d4e881b4fcfd92e2c6d1ff1dbb9a64a76a6f8ee6558499c3c537b22f62bf13a9be5825266d2d498e2a2f81b63295f2e7a65c30482ad110a7c1f1277c8c843ed61a6ed46fa67403136970ada5220079a1b51cdfe9c9fc679b4c3001bbb70964c3227cba677e715b55400a0e6840e7f79daf8e7328d441542bc807abadcfacf1291559d02436736489a384be1c800c1cd23e51e788053b2131f891de7af291d9f6c1cfdc7df82129fb312ba725d7df995dddb65fb2107daf64e3efbed773a2dde026748fbf4904eb371ad3a94da2868891244235c62a53b943d96a2786b5d545fcff97231ebba46ff2274eadd9e6fbb59e60c4de4d290509f6cb7b95f1599ed747d37962400bcff77b5ac5c5980b66b8a1e95b7d273585c262d761d466b050f328c7a34311527c1767087beb56f156e8f34427acffdf8f8264d703a12967166301bbd37efd67f0390b871531396e0c0ce938f2d5bee6b1fbe6f922fb86674d71d51e58ff0907365eaf66f7c0d2db80113f73428092026424965a7c2004be6ee807d2c903bc08a6e66c8c5e9e1b34823236262f462df759a6a63cd6f7cb95ebff5f160af1480eba0095f6378949232a9a549fc69d44baf5cf080edd393cee9f9d502446cf9f77b49d75dca2fdc73fd0bf709c5b66ac9d306c98fdcad916ac542c05c3a4d670bf1af74f58eaa0f6d77854ccd4c4945f1f32130ef18d77f2040aa68a2b9a5d30709405aa98c6dfd138d979212a6ee65e36d96bc59c74de193aa3c4f8f4136d89d38cedb6d247ffc21f1b2e182ec44cf79de3d0bebaa011491e0b9d3b66f5c5647dd2067728daf2a426698a3ab2aac5eeabd2b351d746b0616e6196c2251d693479f555bdaf1d78b51112261a9878cfe71ecfb249913c03254c994afb9c3d13d6c36975f2740cdef891bc1e4be3534d70d07833e59bf1335e260bb546629839de9fe9e7dd092a1e0dfd19aad1d3ec585bb10c6c252e66ee40a44a7cb78c160d9455312d1ef22888cb6480a0142bb9064c978e8f7dc01b3e59a249d4c28cac1a891c8da0298be93f73c9514b22c216c229fa5376eef8ae52c133dc061f35f3ebe06c295f41aba7f4f455d4e5896d88abf6832f33c18a02a454ef0029d35a58468707e3bb2ab326f368f1e0ebcd02d1c8c904d8801439f9a219f9aa3933c4a7a8e1caaa08fbcc3171f8396a541190eeede59e358d8c4b1d3de189d13e5c3bf30766e80ea2d5124515d2f28b401d608599f2d1e689a02e0e433404092793c1f539eb10044004ec36e6dec0ac57ad3df79d6e0999f0ef2eb812980fcc854135314508f17609ec2e7a246a2942bc0b1e86d716c22d3069ab6837dc90a43cd6e195ff69495c68b1a924a96621c2af5aa29288b0d51ba88c045d3a9511a9791a8838778bcd6cfd16b0ee553d90afaa0918c81458b787b3eaccfb1d6fdc4287dfa08661ea7fc2cf63a1f26fb862493ec7543113c221372cc70a49a5a94d674e2bb130f769328928d0aaca49cdf06c43904a51c50e3d451379ff504f0f329d4e832a8d4d51f148fc77cf94357859df4cc0e94dc9b681f15a3afcf6889f8f6d6c016760fff7974828c56d1abd142e9ead885f041634963ae67a42a37d4b19815f0c32a6df0793cf198b3fa0d0902835891968496770a2c299bc3f2a61efb4f64da73e8073c9b7c354f5b8d289cdd336654856197bffd326a9e276a416e23e4a504f83aef01395a14f0d5b8adaebecfed1a9e7a7c5f6b4dc5453e602d80303a37605acecab0eb0a4e5d88aa4b80705795190ae27aafce6dd6dbf46adb959824dfe214981e05280f66edc2659918b60c7558c5e1515ddcd0f05ff2054443de70e7b9b128f3da55de1aafc4401f4e9f5445a436a231b14ca1b1b1b4b491fba459ae058ef37a3f0f120eb5c558733bd761993368506efefd8439a6c1b39f0012cebcacf4cf97fd682bd78bd7376865755e3e0ac4c786cd773cc17aee2c67a3804f143f2797211924ca1415cc634e2d54e04e99115d4efcf7098500ae51d8777078058f165ee6b4d78b7c9364069317410b5ab89742f1cf7d4a1345cccab1e917d22ad3f7f811564f94191740d706b81ae27bbea62898ccf75d64bca944b7b13fc6dc6121e5b3e38adf4be55f8be6e06eedcd92b7294d1c8b3199f0c8f1918bf87796c0d62fad0ade4d86a619d8e1dd4277e9b251df7423440c456892c19854faf883de177f0700b5127894e6409e3803ac368839c8ded063919b4bbab2373a48a6cb0f3a88e2581371e3af19fa10e0c1d4c5f87aba9a004051fd00d0868945817dd28f0b778a82d5d9faeaef0c94966ff4e45516fb55b5f94a02463d88d6019393642dea80f5b9854af28fcf38827c1d60fd4963b6b0c3d7931f74bf0ac541f0d47a0214288bde4f0b12563a030048346e47480093cb1552dbbdbd24a37657fdc800ef3311040421827c4417ec442efb9372ea23a7003f07271c7b2b9515c1ba3f1406e24a4e3a4f6f6d8e2d7d773e1ef62279e562251eb16a8cf48977f0266163cbb04f9af9a4a1743027311a96085396f294efbfac4e0b3632479b6020169af7f5ad24536783cdce7ef568eb3a4c104bba3c1fca17f7be097472afb687fb712e9ce346f01be6c6baf19a93dc57492e5e13b6672a344d7b887f34789386b631648bb988380150fa061e4cd1bfe7df65b0f989491ed04d2439614e241f96c58565a50447fb1b2853832648a2b3e0770b4a89ee65d3437ba6afd436ec0444f7d50247617483fe97fe2dbec492ec6cd3746f5d867e826543e25791cd245c293ec61a39e02ce331f8b9d71c39a067062c837a2112526588e198682dac2f600c02b069104ecbe0f0665db329e0170a053c9785fec516d00075b3a6f02d2998c7e5054452d9a5bacee7dbaa60a3c193e17e146a14e873e023530d254e773037523df250d0dbd3213cc7446e5828b9a9c019cea051f3cd58ca96c0af68736fd19d91042fe66f4122328ce9ba6fd5fdef2e3825ff1660e1eeaf00ee9