乐视网某APP存在两处SQL注入漏洞下载

乐视网某APP存在两处SQL注入漏洞乐视看球app

GET /sports/api/my_teams?devId=864394014414512&version=2.2&pcode=120110183 HTTP/1.1
 User-Agent: Dalvik/1.4.0 (Linux; U; Android 2.3.6; K-Touch W619 Build/GRK39F)
 Host: sports.app.m.letv.com
 Accept-Encoding: gzip
 Proxy-Connection: close
 Connection: close

注入点：devId

GET /dynamic.php?pcode=120110183&devId=864394014414512&act=matches_remind&version=2.2&ctl=index&mod=api20 HTTP/1.1
 User-Agent: Dalvik/1.4.0 (Linux; U; Android 2.3.6; K-Touch W619 Build/GRK39F)
 Host: sports.app.m.letv.com
 Accept-Encoding: gzip
 Proxy-Connection: close
 Connection: close

注入点还是devId

修复方案：

这个app很多注入啊