# 漏洞原理

/ms/mdiy/model/data 路由下代码如下，有个SQL语句查询直接将 linkId 插入查询


会线判断是否存在 modelId 对应的模型，可以先在自定义模型中先进行创建模型，（创建后 modelId 为 auto Increatement）


```

{

"searchJson": "[\n]\n",

"field": "[\n]\n\n",

"html": "\n<template id=\"custom-model\">\n <el-form ref=\"form\" :model=\"form\" :rules=\"rules\" label-width=\"120px\" label-position=\"right\" size=\"small\">\n\n </el-form>\n</template>\n",

"title": "www",

"script": "\n\nvar custom_model = Vue.component(\"custom-model\",{\nel: '#custom-model',\ndata:function() {\nreturn {\n\nmodelId:0,\nmodelName: \"www\",\n//表单数据\nform: {\nlinkId:0,\n},\n\nrules:{\n},\n}\n},\nwatch:{\n},\ncomputed:{\n},\nmethods: {\nvalidate:function(){\nvar b = false\nthis.$refs.form.validate(function(valid){\nb = valid;\n});\nreturn b;\n},\nsave:function(callback) {\nvar that = this;\nvar url = this.formURL.save.url;\nif (that.form.id > 0) {\nurl = this.formURL.update.url;\n}\nthis.$refs.form.validate(function(valid) {\nif (valid) {\nvar form = JSON.parse(JSON.stringify(that.form));\nform.modelId = that.modelId;\nms.http.post(url, form).then(function (res) {\nif(callback) {\ncallback(res);\n}\n});\n}else{\ncallback({result:false,msg:'请检查表单输入项'});\n}\n})\n},\n//获取当前www\nget:function(id) {\nvar that = this;\nms.http.get(this.formURL.get.url, Object.assign({\"modelId\":that.modelId},this.formURL.get.params)).then(function (res) {\nif(res.result&&res.data){\nthat.form = res.data;\n}\n}).catch(function (err) {\nconsole.log(err);\n});\n},\n\n},\ncreated:function() {\n//渲染create\n\nthis.get(this.form.linkId);\n}\n});",

"sql": "\n -- W\n CREATE TABLE `{model}W` (\n `id` BIGINT(11) UNSIGNED NOT NULL AUTO_INCREMENT,\n `LINK_ID` BIGINT(20) DEFAULT NULL,\n `CREATE_DATE` DATETIME DEFAULT NULL COMMENT '创建时间',\n `CREATE_BY` VARCHAR(50) DEFAULT NULL COMMENT '创建人',\n `UPDATE_DATE` DATETIME DEFAULT NULL COMMENT '修改时间',\n `UPDATE_BY` VARCHAR(50) DEFAULT NULL COMMENT '修改人',\n `DEL` INT(1) DEFAULT 0 COMMENT '删除标记',\n PRIMARY KEY (`ID`) USING BTREE\n ) ENGINE=InnoDB DEFAULT CHARSET=utf8 ROW_FORMAT=DYNAMIC COMMENT='www';\n\n",

"tableName": "W"

}

```

# 漏洞证明