The SQL injection vulnerability exists in the APP on the website (where to find the database accidentally)

The SQL injection vulnerability exists in the APP on the website (where to find the database accidentally)

Web app SQL Injection

Detailed description:

Target: APP on the official website of chinan.com

Check that SQL Injection exists in the following places: (injection parameter orderfrom, stacked queries)

Http://www.api.zhuna.cn/e/json_app.php? Tm2 = 2015-11-01 & hid = 135975 & tm1 = 2015-10-31 & orderfrom = 157 & ver = 20 & OS = android & agentId = 157 & unionId = 0 & version = 3.4.0 & OS = android

Proof of vulnerability:

1. SQLMap vulnerability proof

2. Current Database User

3. Current Database

4. list all the databases. A total of 9 databases are listed. Unexpectedly, we can find out where to access the network ~~

Solution:

Please kindly advise ~