An SQL injection sub-station in metersbonwe can obtain a management account

An SQL injection exists in a substation of metersbonwe, which can obtain the management account and connect to the database with a high-permission account. As a result, load_file () can be used to read files.
Detailed description:
The metersbonwe enterprise substation has the SQL injection vulnerability. The site only filters get data and ignores post. As a result, malicious code can be submitted using post to obtain Administrator account information. The password is not complex, successfully cracked md5 to obtain the plaintext and connected to the database using a high-permission account. As a result, the file can be read using load_file (). The absolute path of info file leakage exists on the site, the database connection account information is obtained by reading the configuration file content. due to security reasons, the database does not continue to penetrate further. There are many meibang sites on this server, and www.2cto.com wants to fix them in time.





 
Solution:
Enhance filtering, delete useless files, and enhance Password Complexity

Author HRay