美的电器,美的生活,美的享受
详细说明：
http://rdetoway.midea.com.cn/web/rdlogin.jsp 存在POST注入
抓包
POST /web/SubmitLogin.do HTTP/1.1Host: rdetoway.midea.com.cnUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.3.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://rdetoway.midea.com.cn/web/rdlogin.jspCookie: CPCUserName=11; ch1=true; ch2=false; entcode=mdrd; lastloginuser=11; JSESSIONID=agli4RIEd83__xO14cConnection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 122value%28entcode1%29=mdrd&value%28entcode%29=mdrd&value%28userName%29=11&value%28password%29=111&Submit=%E7%99%BB+%E5%BD%95
POST注入
漏洞证明：
13397个
随便找了一个库
修复方案：
过滤!