注入点:http://b2b.89898989.com/reports/printreceipt.aspx?orderno=406032011601 sa权限 写shell失败 可执行sql命令 写shell也失败 未授权:http://b2b.89898989.com/reports/printreceipt.aspx?orderno=406032011601 orderno参数可控 生成个数字字典 跑一下就OK