12306 shocking SQL Injection Vulnerability

12306 of the Ministry of Railways's websites are exposed to SQL injection vulnerabilities, which is an absolute high-risk level. I looked at it and it was speechless. This kind of mistake is too low-level and should not be done by junior programmers. Isn't it true that 12306 is really a big job at the end of a few undergraduates? Haha, joke.

The vulnerability discoverers are also funny. They say, "the sub-station has an injection, and hundreds of millions of projects have not dared to run the database. If they run badly, they will not be able to afford it ......"

From the following, we can see that the system is based on JavaEE, the SSH framework, the application server WebLogic, the database is Oracle, and C3P0 is used as the connection pool.

Because a single quotation mark is entered, the final SQL statement becomes like the following:

Select * from TB_INFO_CLCS where flag = 'y' and czdm = 'g' and ziz like '% 6' % 'order by cxdm

Think about this. First, it shows that the technical skills of the entire team are average, at least programmers with low levels. Second, it shows that there is a lack of planning and control for project development, one person should assume a function to access data from the interface, and no one reviews the code, so the QA of such a large project is not keeping up; third, the project must have been in a rush.

Alas, the iron Science and Technology Institute also hangs the "Institute" name number. Isn't the level so bad? Or is it really cheap to outsource this project? I really don't take the taxpayer's money as money.