ava代码审计之不安全的Java代码

​ SQLI(SQL Injection)， SQL注入是因为程序未能正确对用户的输入进行检查，将用户的输入以拼接的方式带入SQL语句，导致了SQL注入的产生。攻击者可通过SQL注入直接获取数据库信息，造成信息泄漏。
SQL注入之JDBC注入

​ JDBC有两个方法执行SQL语句，分别是PrepareStatement和Statement。

漏洞代码：

// 采用原始的Statement拼接语句，导致漏洞产生

public String jdbcVul(String id) {

StringBuilder result = new StringBuilder();
try {
    Class.forName("com.mysql.cj.jdbc.Driver");
    Connection conn = DriverManager.getConnection(db_url, db_user, db_pass);

    Statement stmt = conn.createStatement();
    // 拼接语句产生SQL注入
    String sql = "select * from users where id = '" + id + "'";
    ResultSet rs = stmt.executeQuery(sql);

    while (rs.next()) {
        String res_name = rs.getString("user");
        String res_pass = rs.getString("pass");
        String info = String.format("查询结果 %s: %s", res_name, res_pass);
        result.append(info);
    }                  

漏洞代码二：

// PrepareStatement会对SQL语句进行预编译，但有时开发者为了便利，直接采取拼接的方式构造SQL，此时进行预编译也无用。

Connection conn = DriverManager.getConnection(db_url, db_user, db_pass);
String sql = "select * from users where id = " + id;
PreparedStatement st = conn.prepareStatement(sql);
System.out.println("[*] 执行SQL语句：" + st);
ResultSet rs = st.executeQuery();

​
SQL注入之MyBatis

​ MyBatis框架底层已经实现了对SQL注入的防御，但存在使用不当的情况下，仍然存在SQL注入的风险。

漏洞代码：

// 此漏洞出现频率较高并且很严重！
// 为何产生：由于使用 #{} 会将对象转成字符串，形成 order by "user" desc 造成错误，因此很多研发会采用${}来解决，从而造成SQL注入
// 点击运行可通过报错语句获取数据库user

@RequestMapping("/mybatis/vul/order")
public List orderBy(String field, String sort) {

return userMapper.orderBy(field, sort);

}

// mapper.xml语句

select * from users order by ${field} ${sort}

漏洞代码二：
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
https://weibo.com/a/hot/76273...
// 模糊搜索时，直接使用'%#{q}%' 会报错，部分研发图方便直接改成'%${q}%'从而造成注入