Multiple defects of Ao you sub-station

1. SQL error Leak (table, column)
2. phpinfo
3. Apache httpOnly Cookie
4. XSS


1. SQL error Leak (table, column)
Http://help.maxthon.cn//view.php? Cid = 214 & tid = 9
Query Error: SELECT * FROM help_contentindex I left join help_content c USING (tid) WHERE I. tid = '9' AND cid = '123'

2. phpinfo
Http://help.maxthon.cn//test.php

3. Apache httpOnly Cookie Vuln
Help.maxthon.cn

4. XSS

Http://tuan.maxthon.cn: 80 // dianping/index. php? Request = site & sid = 547 & type = "onmouseover = alert (/insight/) bad ="

Http://tuan.maxthon.cn//Search? Page = 5 & Value = "onmouseover = alert (/insight/) bad ="


1. SQL error Leak (table, column)

2. phpinfo

3. Apache httpOnly Cookie www.2cto.com

4. XSS


 

Solution:
1. don't print error message
2. remove file
3. upgrade web server
4. Filter Iuput


Author insight-labs