Injection Vulnerability and repair of a sub-station in tomonline

Brief description: The injection vulnerability of a sub-station in tomonline is not strictly filtered and information is leaked.
Detailed description:
 




Point query, an error will occur...
 
 
 
Loose filtering, just construct...
Http://data.nbl.tom.com/userteam.php? Team_no = NTe008 has the SQL injection vulnerability...
Proof of vulnerability:


The sub-station database information is leaked, and the Administrator account and password are leaked...
 
 
 
 
Solution:
 
 
PHP files are not strictly filtered. You need to modify the error information returned by the server to determine the information submitted by the user, when the parameters submitted by the user contain SQL Injection characters such as "exec, insert, select, delete, from, update, count, and user", the system redirects to the error page.
 
 
Lazy author @ wooyun