Tianyi express SQL injection point to obtain system Permissions

SQL injection vulnerability caused by incomplete filtering during Query

Zero x 0.1
 
What is the announcement http://www.transparcel.com/newsDetail.asp in the announcement bar on the homepage of the website? Id = 67 there is a normal injection point filtering, and the SQL universal anti-Injection System
 
 
 
-However, this filtering is not enough. We can use cookie injection to break through this layer of filtering.
 
Generate
 
 
 
OK. locally, the generated file is thrown into HTTP,
 
 
 
 
Put the local address http: // localhost/jmCook. asp? Jmdcw = 67 drop in the pangolin to see
 
Recognized
 
 
 
 
Create a system account and password guoker
Now let's query the remote terminal port
 
Step 1: Tasklist/SVC lists all processes, system services, and their corresponding PID values!
The service name of the terminal is TermService.
Step 2: run the netstat-ano command to list the PID values of all ports!
Find the port corresponding to the PID Value
 
Find PID
 
 
 
Port search
 
 


 
We can see that the port number is 7362. Use the built-in logon function.
 
 
 
OK
 
Zero x 0.2
 
 
Cause of vulnerability
 
 


No filtering .....

Solution:
Add filter when querying .....
Author GuoKer (ZhuLiu)