An SQL injection exists at a specific place (it can span 5 databases and contain the Administrator table)

An SQL injection exists at a specific place (it can span 5 databases and contain the Administrator table)

An SQL injection exists at a specific place (it can span 5 databases and contain the Administrator table)

Detailed description:

Objective: To launch the travel network APP

Injection found in the following places: (injection parameter id, Boolean blind injection)

Http://activity.yaochufa.com/lottery/getresult/joinprize? Id = 207

Proof of vulnerability:

1. SQLMap vulnerability proof

2. Current Database User

3. list all databases, with a total of 5

4. Let's take a look at the cross-Database

Mask Region

  
   
* ***** Ww _*****

  

There are 37 data tables in the database. Is it from the official website ~~ However, the Administrator table is included ~~

The specific data will not go deep ~