View All audit records across Permissions

Graph web SQL injection is strictly filtered across permissions to view all audit records, resulting in cross-Permission viewing of all records caused by SQL Injection

Test account rainboyhi

Test password: rainboyhi

After successful login, visit the following URL

Http://user.nipic.com/index.asp? Open = pic_list_wait.asp? Shenhe = shenheDENGYU0

We can see that there is no review image, because I didn't upload the image at all.

Then we perform the or 1 = 1 operation to access the following URL.

Http://user.nipic.com/index.asp? Open = pic_list_wait.asp? Shenhe = shenheDENGYU0 % 20or % 201 = 1

This is the last day. You can see all the image information to be reviewed. It is equivalent to having the administrator privilege.

 

Everything is illustrated from the above number of records. Fix it now.