A SQL injection vulnerability in GreenTree Inn

A SQL injection vulnerability in GreenTree Inn

 

Business Operating System:
 

Http://system.greentree.com.cn: 8080/op/Module_ERP/home.htm

Prompt for MAC address verification
 

Do you think this is safe?

Scan a menu list with Yu Jian.
 

Http://system.greentree.com.cn: 8080/op/module_erp/menu. aspx

Then click-website traffic statistics with the permission
 

Http://system.greentree.com.cn: 8080/op/module_erp/market/Search. aspx

Enter a single quotation mark on the date
 

Capture packets and drop them into sqlmap.

Two vertices: txtTime1 txtTime2

Dba permission can be queried across pants
 

 

 

Solution:

Filter