Solutions for SQL injection, file upload, and Restoration

 

Author: Lu renjia

Brief description:

1. On the qianniu file upload page, you can modify the URL parameter id and upload the file to any registered user directory.

Cause: the identity of the Uploader is not verified before the file is uploaded.

2. SQL Injection exists at the same time, and the database root permission can be used to remotely read data.

Cause: user input, cookie, and post data are not filtered.

Details: Both vulnerabilities are on this URL.

Http://upload.qiannao.com/tomos/ui/qnupload.jsp? Id = dazqh

1. If the parameter of the modified id is admin, you can upload the file to the file directory of the admin user.

 

2. At the same time, this URL has a serious injection vulnerability.

 

 

Proof of vulnerability:

 

 

The injection effect can be achieved through pangolin.

Solution: Authenticate the uploaded user.

Filter parameters on the upload page.