hui4401 / studentmanager Goto Github PK

I found a arbitrary password reset in teacher/personal.jsp.
When a user modify its information, here is not a check about who it is, and call update_teacher, update database columns just according to id user controlled.

When a hacker modify uid to someone's uid, someone's information and password can be resetted as what hacker wants.

I found a arbitrary password reset in student/personal.jsp.
When a user modify its information, here is not a check about who it is, and calls update_student_security, updates database columns just according to id user controlled.

When a hacker modify uid to someone's uid, someone's information and password can be resetted as what hacker wants.
Following images are the information not modified, and I login as 20162430635.


I modify the id to 20162430636, and send the package, user-36's information is modified.

Build this project locally

There is a sql registration vulnerability in the login

It is found that there is a splicing of sql statements at the verification login

Vulnerability recurrence

Submit sql injection parameters

user=zzu'/**/and/**/extractvalue(1,concat(0x7e,(select/**/database()),0x7e))#&password=admin

I found a sql inject in one_page_student.findWithId/findWithName.
Set a breakpoint as follows:

When I use payload one_page_student?key=1' or '1'='1，it hits the breakpoint.


After executing String sql=...， sql becomes

After executing sql query, al is filled with information

报错java.sql.SQLException: Access denied for user 'root'@'localhost' (using password: YES)
但是我用main方法是可以连上数据库的
请问下如何解决

I detected a sql inject in login.jsp by source code review.
In detail, the code in teacherD/studentD.checkAccount concat the username and password with sql, and cause a sql inject.

The vuln can be exploit by payload 1' or '1'='1 and access main.jsp successfully without true password.