Kingsoft Ciba has SQL injection in the background of a website.

Kingsoft Ciba has SQL injection in the background of a website.

Kingsoft

Injection of this site before

WooYun: a management system leaked a lot of Kingsoft MAC (tftp + ftp account 30 + decrypted MD5 enters the management background)

Decrypt the login with the first account posted
 

Chenhui1 password chenhui2

Log on to the background

You can manage the homepage content
 

I have taken a look at the obvious injection.



Http://mis.iciba.com/clientindex.php? Action = view & id = 946



Available databases [4]:

[*] Clientindex

[*] Ds_data

[*] Iciba_mis

[*] Information_schema
 

Solution:

The solution should be thorough. The leaked account should be changed to the password and strictly filtered.