Multiple vulnerabilities in Ruili female substations can cause server intrusion

Http://lifestyle.rayli.com.cn/manager/index.php background Leakage
Arbitrary user name login such as 123 123
SQL Injection http://lifestyle.rayli.com.cn/inseasonnow/userdish.php? Id = 3740362
Nginx Parsing Vulnerability
Target: http://lifestyle.rayli.com.cn/inseasonnow/userdish.php? Id = 3740362
Host IP: 60.2.251.193
Web Server: nginx
DB Server: MySQL error based
Resp. Time (avg): 88 MS
SQL Version: 5.1.40-log
Current DB: lifestyle
Host Name: 0.6
Installation dir:/usr/local/mysql-5.1.40-linux-i686-icc-glibc23/

And so on ..........

Injection:

Arbitrary background Logon:

 



Www.2cto.com

Nginx Parsing Vulnerability

 

You can use the shell

Solution:
You know

Beginner

Author 0x4d5