Lenovo's SQL injection (tens of millions of users)

Lenovo's SQL injection (tens of millions of users)

I would be drunk if I was using a small vendor .. Check the data

Website: http://think.lenovo.com.cn/



Manual test shows an injection point

Http://think.lenovo.com.cn/stations/Api/QueryMap.ashx? Area = 0451 & type = ThinkPad



The area parameter can be injected.



Run SQL map directly.


 

available databases [14]:

 

Where

serviceshop

It is the database of Lenovo service Mall.

Website: http://serviceshop.lenovo.com.cn/





Let's take a look at the hazards. Try running a database


 

[301 tables]

 

The User table, order table, and shipping address table are not described in detail.





Check the number of user tables.
 

It's just a user table that has so many users.



Order and other sensitive information will not be viewed



Don't talk about the impact.
 

 

 

Solution:

Filter