Weaver collaborative commerce system e-cology SQL injection (with verification transfer script)

Weaver collaborative commerce system e-cology SQL injection (with verification transfer script)

Find one.

Http: // **. **/services/MobileService? For example

Use wvs

CheckUserLogin Method

The three parameters are numeric, numeric, and numeric.

3 is returned when it is correct.

Error 4 returned

(WSockExpert)

A certain degree of search has a high score.

The result system has a certain degree of audio/video and a certain input method)

Continue to use

View User Length

Checkuserlogin is used only for verification.

Self-check for other items

The case is really troublesome.

If you directly use a transit script, you cannot tell which website the website is.

Five cases

Case 1: http: // **. **/services/MobileService? Wsdl

After test, it is found that 5 errors are returned. 4 Interpretation length is used to intercept the string and substr is used.

Parts are as follows:

-----------------

Case 2: http: // **. **/services/MobileService? Wsdl

Returns 5 correctly. Returns 4. determines the length. Uses len.

 

----------

Case 3: http: // **. **/services/MobileService? Wsdl

--------

Case 4

Wanda **. **: 88/services/MobileService? Wsdl

--------------

Case 5

Http: // **. **: 88/services/MobileService? Wsdl