The SQL injection vulnerability in a housing provident fund management system is of high permissions.

The SQL injection vulnerability in a housing provident fund management system is of high permissions.

Ben diaosi saw the high-rise buildings on the floor outside the window, but he did not have his own one square meter. He saw the Provident Fund website, so ..

Detailed description:

The parameters of a housing provident fund management system are not strictly filtered, resulting in SQL injection vulnerabilities, and all permissions are sa permissions ..

Case:

Http ://**.**.**.**/

Http ://**.**.**.**/

Http ://**.**.**.**/

Http ://**.**.**.**/

Http ://**.**.**.**/

The injection points are in two files:

Search. asp

Showguestbook. asp

Proof of vulnerability:

1. search. asp

Http: // **. **/search. asp

Sa permission:

2. showguestbook. asp

Http: // **. **/showguestbook. asp

Solution:

Filter.