New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

【严重】数据库查询漏洞 #4

Open

yuantuo666 opened this issue Dec 16, 2022 · 0 comments

yuantuo666 commented Dec 16, 2022

利用此漏洞可查询数据库中所有订单数据。

问题文件：https://github.com/Boshou/hmyk/blob/master/application/api/controller/v1/Pisces.php

问题方法：orderSearch

复现方法：访问 https://HOST/api/v1/pisces/orderSearch?search_type
将返回所有数据库订单数据

yuantuo666 added a commit to yuantuo666/hmyk that referenced this issue


          修复 数据库查询漏洞 w-hehe#4

8763ada

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment