Cool music WWW main site + multiple substations SQL Injection Vulnerability

Cool music WWW main site + multiple substations SQL Injection Vulnerability

Cool music WWW main site + multiple substations SQL Injection Vulnerability

The SQL injection vulnerability exists in the WWW main site and multiple substations, and is submitted together. Injection site:

http://www.kuwo.cn/p/mb/GetContent?from=mobile&id=123&mbuid=53036462

http://tupian.kuwo.cn/p/mb/GetContent?from=mobile&id=123&mbuid=53036462

http://huodong.kuwo.cn/p/mb/GetContent?from=mobile&id=123&mbuid=53036462

http://yinyue.kuwo.cn/p/mb/GetContent?from=mobile&id=123&mbuid=53036462

http://yule.kuwo.cn/p/mb/GetContent?from=mobile&id=123&mbuid=53036462

... There may be other substations...

The cause should be the same problem: GetContent does not filter the id parameter during implementation, leading to the SQL injection vulnerability.

SQL map is not used for injection, but it is indeed time-based SQL injection.

The length of manual user () is 18.

Run the script to run the current user, root injection

Solution:

Perform O & M to fully check other sites and Remove unused systems in time. Otherwise, the security of other sites will be affected.