Seven-day SQL injection under the master system permission restriction of the internal system of hotel chains

To enter the front-end store system has laid a solid foundation http://inner.7daysinn.cn/FindHotel/Default.aspx internal system some functions by the button disabled to restrict permissions this way is equivalent to the virtual, through the browser to delete the disabled parameter can be used. The following is a brute-force table and field. Here, we skipped 'and (select top 50 table_name +', 'from information_schema.tables where table_schema = 'inner' for xml path ('')> 0 and ''= 'Next is another place. Use' or '%' = 'to disclose the computer authorization information of all branches.
There are other points. Please search for them by yourself. Thank you!Solution:Filter