Wanda movie SQL Injection Vulnerability

Wanda movie SQL injection vulnerability with a URL redirection

1. Wanda movie SQL Injection Vulnerability

Problem page:

Http://www.wandafilm.com/baseInfo/news/news.do? Cate_id = 900 & items_per_page = 1 & m = ajaxServiceList & rond = 0.5514420296531171 & showIndex = 1

The items_per_page parameter is not strictly filtered.

Gal'

Limited technology, not in-depth



2. URL redirection arbitrary jump. The target url parameter is not checked and can be phishing.

The specific website is:

Http://www.wandafilm.com/setCity.do? Code = 8022251040 & m = film_info_init_next & reqUrl = http://www.bkjia.com

Click the test URL to jump to the red/Black alliance.

Solution:

Filter out ...........