啪啪啪游戏厅某处漏洞涉及一百四十万用户信息(用户名/密码/支付信息/游戏信息)

http://tuis.papa91.com/?aid=NQZFok

available databases [27]:
 [*] binlog
 [*] cnxy_ad_android
 [*] cnxy_cdk
 [*] games_collect
 [*] information_schema
 [*] mg_bbs
 [*] mg_bbs2
 [*] mg_bbs3
 [*] mg_main_db
 [*] mg_monitor
 [*] mg_pap_bbs_bak
 [*] mg_papa_ad
 [*] mg_papa_ad_ios
 [*] mg_papa_ad_v2
 [*] mg_sso
 [*] mysql
 [*] papa_weixinrec
 [*] papa_yunying_analysis
 [*] papa_yunying_analysis2
 [*] papa_yunying_analysis20150403
 [*] quickbug
 [*] test
 [*] ultrax
 [*] xyandroid
 [*] xyandroid_bbs
 [*] xyandroid_cdk
 [*] xyandroid_user

Database: xyandroid_user
 +------------------------+---------+
 | Table                  | Entries |
 +------------------------+---------+
 | xyandroid_user         | 1455770 |
 | xyandroid_login_log_e  | 184446  |
 | xyandroid_login_log_6  | 176712  |
 | xyandroid_login_log_4  | 176561  |
 | xyandroid_login_log_d  | 176531  |
 | xyandroid_login_log_5  | 176438  |
 | xyandroid_login_log_b  | 174540  |
 | xyandroid_login_log_2  | 172134  |
 | xyandroid_login_log_1  | 171692  |
 | xyandroid_login_log_c  | 169810  |
 | xyandroid_login_log_3  | 166866  |
 | xyandroid_login_log_a  | 166180  |
 | xyandroid_login_log_f  | 161147  |
 | xyandroid_login_log_0  | 156517  |
 | xyandroid_login_log_9  | 155086  |
 | xyandroid_login_log_7  | 155079  |
 | xyandroid_login_log_8  | 154075  |
 | xyandroid_login_0      | 91670   |
 | xyandroid_login_e      | 91613   |
 | xyandroid_login_3      | 91252   |
 | xyandroid_login_f      | 91232   |
 | xyandroid_login_5      | 91205   |
 | xyandroid_login_d      | 91181   |
 | xyandroid_login_c      | 91027   |
 | xyandroid_login_9      | 91014   |
 | xyandroid_login_2      | 90977   |
 | xyandroid_login_1      | 90813   |
 | xyandroid_login_a      | 90777   |
 | xyandroid_login_6      | 90768   |
 | xyandroid_login_8      | 90624   |
 | xyandroid_login_b      | 90507   |
 | xyandroid_login_7      | 90400   |
 | xyandroid_login_4      | 90397   |
 | xyandroid_pay_6        | 19438   |
 | xyandroid_pay_2        | 18954   |
 | xyandroid_pay_5        | 18881   |
 | xyandroid_pay_4        | 18824   |
 | xyandroid_pay_f        | 18622   |
 | xyandroid_pay_0        | 18570   |
 | xyandroid_pay_c        | 18123   |
 | xyandroid_pay_1        | 18019   |
 | xyandroid_pay_a        | 17871   |
 | xyandroid_pay_d        | 17837   |
 | xyandroid_pay_7        | 17745   |
 | xyandroid_pay_b        | 17589   |
 | xyandroid_pay_3        | 17449   |
 | xyandroid_pay_8        | 16825   |
 | xyandroid_pay_9        | 16724   |
 | xyandroid_pay_e        | 16399   |
 | xyandroid_deed_log_7   | 2494    |
 | xyandroid_deed_log_6   | 2347    |
 | xyandroid_deed_log_d   | 2296    |
 | xyandroid_deed_log_3   | 2262    |
 | xyandroid_deed_log_2   | 2223    |
 | xyandroid_deed_log_5   | 2208    |
 | xyandroid_deed_log_f   | 2157    |
 | xyandroid_deed_log_9   | 2154    |
 | xyandroid_deed_log_c   | 2152    |
 | xyandroid_deed_log_4   | 2131    |
 | xyandroid_deed_log_b   | 2080    |
 | xyandroid_deed_log_a   | 2072    |
 | xyandroid_deed_log_1   | 2038    |
 | xyandroid_deed_log_e   | 1977    |
 | xyandroid_deed_log_8   | 1949    |
 | xyandroid_sys_sequence | 1       |
 +------------------------+---------+

Database: xyandroid_user
 Table: xyandroid_user
 [27 columns]
 +-------------+---------------------+
 | Column      | Type                |
 +-------------+---------------------+
 | active_type | tinyint(1)          |
 | address     | varchar(255)        |
 | appid       | varchar(50)         |
 | birthday    | int(10) unsigned    |
 | cip         | char(16)            |
 | ctime       | int(10) unsigned    |
 | ctype       | varchar(16)         |
 | email       | varchar(64)         |
 | equip       | varchar(128)        |
 | idcard      | char(18)            |
 | macaddr     | varchar(64)         |
 | mobile      | varchar(20)         |
 | nickname    | varchar(64)         |
 | password    | varchar(64)         |
 | qqopenid    | varchar(64)         |
 | realname    | varchar(40)         |
 | safea1      | varchar(256)        |
 | safea2      | varchar(255)        |
 | safeq1      | varchar(4)          |
 | safeq2      | varchar(4)          |
 | sex         | tinyint(1) unsigned |
 | source      | varchar(16)         |
 | status      | tinyint(1)          |
 | uid         | int(10) unsigned    |
 | username    | varchar(80)         |
 | wbopenid    | varchar(64)         |
 | wxopenid    | varchar(64)         |
 +-------------+---------------------+