SQL Injection for a website (a large number of Personal Data leaks \ free-of-charge items \ arbitrary item modification)

SQL Injection for a website (a large number of Personal Data leaks \ free-of-charge items \ arbitrary item modification)

SQL injection can expose a large number of members to submit their personal information and administrative staff to improve their confidentiality, so as to display the website front-end information and increase the number of products, and any sort of pay-as-you-go.

Detailed description:

Several field names

Modify a sentence

Quickly export Data

Other functions will not be shown, so you can bring up or down all the products you see on the entire site,

The statement can be changed to pay-as-you-go.

Proof of vulnerability:

Http ://**.**.**.**/
Then you can find a php file to inject it.
Http: // www. **/pro-page.php? Id = 113
Post-renewal address: http: // **. **/admin

This MD5 password is still decrypted to a certain extent.

MAK_supervisor

25963382mak

Solution:

Fix the php statements that contain SQL Injection and perform password-based modification.

Change the post-renewal address.