Floating HOME hotel chain stores Multiple SQL injections on a station (DBA permission/nearly orders)

Floating HOME hotel chain stores Multiple SQL injections on a station (DBA permission/nearly orders)

Floating HOME hotel chain
 

Http://www.piaohomeinn.com injection point:

Http://www.piaohomeinn.com/hotelList? Shard id = 43

 

Http://www.piaohomeinn.com/hotelComments? Consumer id = 37 & commentId = 4906 # commentSearch

Http://www.piaohomeinn.com/ajaxResp? Type = orderDetail & ordersign = 20151218124430 oz

 

 

Ph_user is the user information table, and ph_order is the user order table.
 

 

 

Solution:

You are more professional than me.