General SQL Injection exists in the student management system of a University (Security Mechanism bypass skills)

#1. A university management system developed by odta has an injection vulnerability. The injection vulnerability occurs in the logon box, although s determines the legality of user data submission, however, this can all be bypassed = _ =! Example: http: // 202.117.144.50/login/loginpageforuserb. aspx? LogoutURL = % 2 flogin

Look at the source code of the logon page. We can see that it is indeed a JS limitation of = _ =!

<Script type = "text/javascript"> // <! [CDATA [var VS ___ Page = document. all? Document. all ["VS ___ Page"]: document. getElementById ("VS ___ Page"); VS ___ Page. headertext = "your input has the following error:"; VS ___ Page. showmessagebox = "True"; VS ___ Page. showsummary = "False"; var RFV_txtUserId = document. all? Document. all ["RFV_txtUserId! "; RFV_txtUserId.display =" None "; RFV_txtUserId.evaluationfunction =" inline "; RFV_txtUserId.initialvalue =" "; var REV_txtUserId = document. all? Document. all ["REV_txtUserId"]: document. getElementById ("REV_txtUserId"); identifier = "txtUserId"; REV_txtUserId.errormessage = "[username] format error. correct format: enter single quotation marks \ '"; REV_txtUserId.display = "None "; REV_txtUserId.evaluationfunction = "RegularExpressionValidatorEvaluateIsValid"; REV_txtUserId.validationexpression = "[^ \ '] *"; var RFV_txtPwd = document. all? Document. all ["RFV_txtPwd"]: document. getElementById ("RFV_txtPwd"); RFV_txtPwd.controltovalidate = "txtPwd"; RFV_txtPwd.errormessage = "[Password] cannot be blank! "; RFV_txtPwd.display =" None "; RFV_txtPwd.evaluationfunction =" RequiredFieldValidatorEvaluateIsValid "; RFV_txtPwd.initialvalue =" "; var REV_txtPwd = document. all? Document. all ["REV_txtPwd"]: document. getElementById ("REV_txtPwd"); expires = "txtPwd"; REV_txtPwd.errormessage = "[Password] format error. correct format: enter single quotation marks \ '"; REV_txtPwd.display = "None "; REV_txtPwd.evaluationfunction = "RegularExpressionValidatorEvaluateIsValid"; REV_txtPwd.validationexpression = "[^ \ '] *"; //]> </script>

 

Capture packets = _ = !! Then we continue to submit and bypass the local JS restrictions == !! Enumeration of several cases <warning: the following cases only for Cncert recurrence test, other people can not be used illegally, otherwise the consequences are at your own risk>: http://zhaojiu.xzmy.edu.cn/login/loginpageforuserb.aspx? LogoutURL =/login & c = 1 http://job.xaufe.edu.cn/Login/loginpageforuserb.aspx of Tibet Nationalities Institute? LogoutURL = http: // 202.117.144.50/login/loginpageforuserb. aspx? LogoutURL =/login Shaanxi Normal University http: // 202.117.112.29/Login/loginpageforuserb. aspx? LogoutURL =/login Xi'an University of Electronic Science and Technology http: // 202.117.3.62: 5002/Login/LoginPageForuserB. aspx Xi'an Jiaotong University http://xg.chd.edu.cn/Login/loginpageforuserb.aspx? LogoutURL =/login & c = 1 Changan University http: // 219.244.0.28/login/loginpageforstudentb. aspx yan'an University uses Shaanxi University of Science and Technology as an example to demonstrate: http: // 202.117.144.50/login/loginpageforuserb. aspx? LogoutURL =/login Database: Studwork6 [353 tables]

+ ------------------------------- + | Dbo. I $ _ tstud_Student | dbo. J $ tsys_NoticeType | dbo. JV $ Dtsys_NoticeType | dbo. JV $ tsys_NoticeType | dbo. SNP_CDC_OBJECTS | dbo. SNP_CDC_SET | dbo. SNP_CDC_SET_TABLE | dbo. SNP_CDC_SUBS | dbo. SNP_CHECK_TAB | dbo. voteList | dbo. vsign_AgtRegistry | dbo. vsign_AgtRegistryFell | dbo. vsign_AgtRegistryOrder | dbo. [Vdorm_buildingInfo [No] | dbo. [tDorm_User [No] | dbo. [tsys_Modules _ test] | dbo. [tsys_NoticeType website] | dbo. [vDorm_OccupiedRoom [No] | dbo. dtproperties | dbo. qg | dbo. setup | dbo. sysconstraints | dbo. syssegments | dbo. tAcc_File | dbo. tCadreGroup_state | dbo. tCadre_dimission | dbo. tCode_DeregReason | dbo. tDerate_Temp | dbo. tDorm_Area | dbo. tDorm_Bed | dbo. tDorm_Building | dbo. tDorm_ChargeHistory | dbo. tDorm_History | dbo. tDorm_RewardHistory | dbo. tDorm_Room | dbo. tDorm_RoomMaster | dbo. tDorm_RoomType | dbo. tDrom_BuildingUser | dbo. tEmp_BothMeeting | dbo. tEmp_BothMeetingUnit | dbo. tEmp_BothMeetingUnitSpec | dbo. tEmp_UnitVideo | dbo. tEmp_ViewCounter | dbo. tEmp_codeComputerLevel | dbo. tEmp_codeLiteracyDegree | dbo. tEmp_codeMandarin | dbo. tEmp_codeUnitEconomyType | dbo. tEmp_codeUnitLevel | dbo. tEmp_codeUnitSubjection | dbo. tEmp_codeUnitTrade | dbo. tEmp_codeUnitType | dbo. tEmp_codeWageManageType | dbo. tEmp_gbRegionalism | dbo. tEmp_pblDeptDate | dbo. tEmp_pblEmployment | dbo. tEmp_pblSpecIntro | dbo. tEmp_signAgtRegistry | dbo. tEmp_studAcc | dbo. tEmp_studFavorite | dbo. tEmp_studIntro | dbo. tEmp_studTouch | dbo. tEmp_unitAcc | dbo. tEmp_unitBaseInfo | dbo. tEmp_unitEmploy | dbo. tEmp_unitFavorite | dbo. tFile_Video | dbo. tGreen_Apply | dbo. tMin_Activity | dbo. tMin_InMoney | dbo. tMin_OutMoney | dbo. tMin_Visit | dbo. tPoor_Student | dbo. tPoor_StudentRevocation | dbo. tPopedom_Atom | dbo. tReg_register | dbo. tSim_Appraise | dbo. tSim_Punish | dbo. tSim_Reward | dbo. tSloan_Apply | dbo. tSloan_ApplyAuditing | dbo. tSloan_Condition | dbo. tSloan_Exempt | dbo. tSloan_ExemptAuditing | dbo. tSloan_Repay | dbo. tSloan_Type | dbo. tSloan_Unit | dbo. tStudCadre_Info | dbo. tStudCadre_Type | dbo. tStudCadre_Unit | dbo. tStud_AllowApply | dbo. tTemp_Apply | dbo.tar restart | dbo.tar m_StudRecord | dbo.tar m_policy | dbo.tar restart | dbo. tasl_affrem | dbo. tasl_Bank | dbo. tasl_BankAuditing | dbo. tasl_BankBargain | dbo. tasl_Breach | dbo. tasl_Compensate | dbo. tasl_End | dbo. tasl_Estate | dbo. tasl_Extend | dbo. tasl_Familial | dbo. tasl_Imburse | dbo. tasl_LoanType | dbo. tasl_Postponed | dbo. tasl_SchoolAuditing | dbo. tasl_SchoolAuditingIdea | dbo. tasl_StudRequisition | dbo. tasl_Whither | dbo. tbase_Department | dbo. tbase_Teacher | dbo. tbase_User | dbo. tbase_UserID_UserNO | dbo. tborrow_enrol | dbo. tborrow_ratify | dbo. tborrow_repay | dbo. tcard_AllowSpec | dbo. tcard_InviteUnit | dbo. tcard_MakeCard | dbo. tcard_ScanCard | dbo. tcgb_Folk | dbo. tcgb_PolityVisage | dbo. tcgb_Regionalism | dbo. tcgt_AwardGrade | dbo. tcgt_AwardList | dbo. tcgt_ClassRelation | dbo. tcgt_StudCourse | dbo. tcgt_StudRecord | dbo. tcgt_stdResultCell | dbo. tcgt_stdScale | dbo. tcmoe_BloodType | dbo. tcmoe_Emigrant | dbo. tcmoe_PunishType | dbo. tcmoe_RewardLevel | dbo. tcmoe_RewardType | dbo. tcmoe_StatusChangeCause | dbo. tcmoe_StatusChangeType | dbo. tcode_Academic | dbo. tcode_Aspect | dbo. tcode_Degree | dbo. tcode_LenOfSchool | dbo. tcode_Post | dbo. tcode_PsychologyLevel | dbo. tcode_StudType | dbo. tcode_TeacherRole | dbo. tcode_poorType | dbo. tcpt_BranchActivity | dbo. tcpt_ClassRelation | dbo. tcpt_Document | dbo. tcpt_MemberStudy | dbo. tcpt_PartyActive | dbo. tcpt_PartyBranch | dbo. tcpt_PartyMember | dbo. tcpt_PartyPrep | dbo. tcpt_PersonRelation | dbo. tcpt_Requisition | dbo. tderate_AuditSchooling | dbo. tderate_RegSchooling | dbo. temp_CodeStudType | dbo. temp_SMS | dbo. temp_Student | dbo. temp_displayitem | dbo. tev_ClassAssess | dbo. tev_ClassAssessTemp | dbo. tev_EvaluatingItem | dbo. tev_EvaluatingType | dbo. tev_StudAssess | dbo. tev_StudAssessTemp | dbo. tgreen_Charge | dbo. tgreen_temp | dbo. titem_DeregType | dbo. titem_PartyBranchType | dbo. titem_PartyMemberType | dbo. titem_PartySchoolType | dbo. tlv_Procedure | dbo. tlv_RegForGraduate | dbo. tlv_Schema | dbo. tmem_BookEnrol | dbo. tmem_ChooseCadre | dbo. tmem_Development | dbo. tmem_DevelopmentNum | dbo. tmem_MemBerDocment | dbo. tmem_MemCharge | dbo. tmem_Member | dbo. tmem_OrgType | dbo. tmem_Party | dbo. tmem_PartyNum | dbo. tmem_Record | dbo. tmem_Rewards | dbo. tmem_TrainDepartment | dbo. tmem_TrainManInfo | dbo. tmem_orgMan | dbo. tmem_organization | dbo. tmema_ActivityApply | dbo. tmema_ActivityAudit | dbo. tmema_ActivityField | dbo. tmema_AssnJob | dbo. tmema_AssnMember | dbo. tmemp_Activity | dbo. tmemp_ComAuthor | dbo. tmemp_ComManuscript | dbo. tmemp_ComReport | dbo. tmemp_PublicationIssue | dbo. tmemp_PulicJob | dbo. tpopedom_UserBackManage | dbo. tpopedom_UserModule | dbo. tpsy_BBSMain | dbo. tpsy_BBSRestore | dbo. tpsy_Dossier | dbo. tpsy_Emphases | dbo. tpsy_Preengage | dbo. tpsy_Talk | dbo. tpsy_Work | dbo. tpunish_Information | dbo. tpunish_Repeal | dbo. tqgzx | dbo. tqgzx1128 | dbo. tqgzxbf | dbo. treward_Information | dbo. treward_InformationG | dbo. treward_Repeal | dbo. treward_Type | dbo. tsafety_InsurePayforMoney | dbo. tsafety_InsureRegStudent | dbo. tsafety_SafetyGrade | dbo. tschol_Annotion | dbo. tschol_Apply | dbo. tschol_Classify | dbo. tschol_Quotas | dbo. tschol_RankObj | dbo. tssc_History | dbo. tstipend_Annotion | dbo. tstipend_Apply | dbo. tstipend_Classify | dbo. tstipend_Quotas | dbo. tstipend_RankObj | dbo. tstud_Accessories | dbo. tstud_CardPrint | dbo. tstud_CardPrintFiled | dbo. tstud_Educate | dbo. tstud_Family | dbo. tstud_FieldEdit | dbo. tstud_Graduate | dbo. tstud_NewStudent | dbo. tstud_Student | dbo. tstud_StudentTest | dbo. tsubsidy_Annotion | dbo. tsubsidy_Apply | dbo. tsubsidy_Classify | dbo. tsubsidy_Quotas | dbo. tsubsidy_RankObj | dbo. tsys_Download | dbo. tsys_EmpNavigation | dbo. tsys_FriendlyLink | dbo. tsys_Message | dbo. tsys_Modules | dbo. tsys_Notice | dbo. tsys_NoticeInterface | dbo. tsys_NoticeType | dbo. tsys_Options | dbo. tsys_VoteList | dbo. tsys_VoteProject | dbo. tsys_VoteRen | dbo. tsys_loginLog | dbo. tsys_loginSession | dbo. tt | dbo. twl_WorkLog | dbo. twork_Apply | dbo. twork_CheckIn | dbo. twork_Department | dbo. twork_PayMoney | dbo. twork_PostObj | dbo. twork_PostType | dbo. vAloan_ListAff | dbo. vAloan_ListBasic | dbo. vAloan_ListExtend | dbo. vCadreGroup_state | dbo. vDerate_green_Stat | dbo. vDorm_AllRoomDetail | dbo. vDorm_Bed | dbo. vDorm_BuidingCode | dbo. vDorm_CanBePreared | dbo. vDorm_CanUseBed | dbo. vDorm_Preared | dbo. vDorm_StudBedInfo | dbo. vDorm_UsedBed | dbo. vDorm_building | dbo. vDorm_room | dbo. vDorm_student | dbo. vGreen_Apply | dbo. vGreen_YearsMoney | dbo. vMin_EmpSearch | dbo. vMin_RPSearch | dbo. vMin_ScholSearch | dbo. vMin_Stipent | dbo. vMin_SubSearch | dbo. vMin_SysNumber | dbo. vMin_WorkStudSearch | dbo. vSchol_QuotaForDept | dbo. vSim_Reward | dbo. vbase_Department | dbo. vbase_UserStudAllForLogin | dbo. vcard_Student | dbo. vcgt_AwardList | dbo. vcgt_StatGradeRecord | dbo. vcgt_StudSumRecord | dbo. vcgt_student | dbo. vderate_RegSchooling | dbo. vderate_XNMoney | dbo. vderate_YearsMoney | dbo. vemp_StudCompleteInfo | dbo. vemp_Student | dbo. vemp_StudentAll | dbo. vgreen_StudApply | dbo. vins_InsGrade | dbo. vjob_StudInfo | dbo. vlv_GraduateState | dbo. vparty_PersonRelation | dbo. vparty_StatBranchSum | dbo. vpopedom_UserModule | dbo. vpsy_Dossier | dbo. vsafety_StatDeptInsurePay | dbo. vsafety_StatDeptInsureSum | dbo. vschol_Classify | dbo. vschol_QuotaForClass | dbo. vschol_QuotaForGrade | dbo. vschol_XNMoney | dbo. vschol_YearsMoney | dbo. vstipend_Classify | dbo. vstipend_QuotaForClass | dbo. vstipend_QuotaForDept | dbo. vstipend_QuotaForGrade | dbo. vstipend_XNMoney | dbo. vstipend_YearsMoney | dbo. vstud_Student | dbo. vstud_StudentAll | dbo. vstud_StudentGraduate | dbo. vstud_StudentInschool | dbo. vsubsidy_Classify | dbo. vsubsidy_QuotaForClass | dbo. vsubsidy_QuotaForDept | dbo. vsubsidy_QuotaForGrade | dbo. vsubsidy_XNMoney | dbo. vsubsidy_YearsMoney | dbo. vunit_Unit | dbo. vwork_Department | + ------------------------------- +

 

The background is no longer accessible. The student management system is impossible without student information ~