12369 Environmental Protection Information Network Master site root permission SQL injection/XSS Vulnerability

12369 Environmental Protection Information Network Master site root permission SQL injection/XSS Vulnerability

RT

Vulnerability address:

Http: // **. **/news/list? Title = a & type_id = 1

 

 

The title parameter contains Boolean injection and time injection, which are filtered, numbered, and run on the script.

Current User name: root @ localhost
 

The test xss finds that the input on + * is filtered out, but the onon + ** method can be bypassed.
 

Solution:

@@