The SQL Injection Vulnerability (containing more than million merchant data) exists in the official Wanda feifan APP)

The SQL Injection Vulnerability (containing more than million merchant data) exists in the official Wanda feifan APP)

SQL Injection for APP security

Target: Wanda feifan merchant APP

SQL Injection exists in the following areas: (userName in POST, time blind injection)
 

POST https://api.ffan.com/xadmin/login HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=UTF-8User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.2; X9180 Build/KVT49L)Host: api.ffan.comConnection: Keep-AliveAccept-Encoding: gzipContent-Length: 154uid=-1&loginToken=n%2Fa&agid=n%2Fa&userName=13365236325&authRangeType=store%2Cmerchant&password=hfdhvxg%3Af&appType=bpMobile&clientType=Android&version=8&

 

1. SQLMap vulnerability proof
 

2. List current database users
 

3. list all databases
 

4. list all tables in the current database and discover the merchant User table, which contains more than million merchant data ~
 

 

 

Solution:

Please kindly advise ~