Web substation SQL injection and sensitive information leakage

Web substation SQL injection and sensitive information leakage an injection point... and a leakage of sensitive information ...,,,,

Http://licaike.hexun.com/GjzDetail.action? ProdCode = 400008 & prodType = S



The prodCode has a problem.



An error is reported when a quotation mark is added.



Digital bool blind Injection

Http://licaike.hexun.com/GjzDetail.action? ProdCode = 400008% 20and % 201 = 1 & prodType = S

True

Http://licaike.hexun.com/GjzDetail.action? ProdCode = 400008% 20and % 201 = 2 & prodType = S

False

False is a server error page



In addition, this server also supports php parsing, and should be installed in the LAMP package.

This is the case.



Http://licaike.hexun.com/test.php



Phpinfo exists
 

PATH /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/binSERVER_SIGNATURE no valueSERVER_SOFTWARE Apache/2.2.23 (Unix) PHP/5.3.23SERVER_NAME licaike.hexun.comSERVER_ADDR 10.2.21.22SERVER_PORT 80REMOTE_ADDR 10.3.2.22DOCUMENT_ROOT /usr/local/apache2/htdocsSERVER_ADMIN you@example.comSCRIPT_FILENAME /usr/local/apache2/htdocs/test.php

Solution:

Delete the test. php file
Convert numeric type