A mobile phone system in China causes SQL injection to leak a large number of databases

A mobile phone system in China causes SQL injection to leak a large number of databases

URL: http://subadmin.cnmo.com

First, the system will return the user does not exist and the password is wrong. So I started to use top500 to run the user name and then brute force password cracking. After a while, the system prompts that the account has been banned for too many times.
 

Then I tried to see if X-Forwarded-For can be used to bypass it. In this case, I can add a single quotation mark and report an error.
 

Then manually verify
 

 

We can see that there is a Boolean blind note to decisively use sqlmap.
 

 

Library missing

PS: the premise of injection is to use an existing user name to submit For Logon multiple times so that the system returns too many times and then use X-Forwarded-For injection to directly note that this is not acceptable.

Solution:

Filter