hunt.database.Statement存在识别参数错误和SQL注入风险

[zhkkjun]

问题方法：private string sql(SqlConnection conn)

重现代码： auto db = new Database("mysql://root:root@localhost:3306/asp?charset=utf8mb4"); auto conn = db.getConnection(); Statement stmt = db.prepare(conn, "SELECT * FROM sys_user where Name = :username "); //下面一行会发生错误:username后缺少空格会导致参数无法被替换导致SQL错误 //Statement stmt = db.prepare(conn, "SELECT * FROM sys_user where Name = :username"); // 这里可以直接注入成功，说明字符串是直接拼接的 stmt.setParameter("username", "' OR ''='"); RowSet rs = stmt.query(); foreach (row; rs) { writeln(row["Name"]); } conn.close(); db.close(); readln();

结果：输出了所有数据

[Heromyth]

We will do more tests about this. Thanks.